a4d7294a5884c13f0941d9363774e378852148c10859ea9151762282a6ab4000

Analysis

max time kernel
38423s
max time network
134s
platform
linux_mipsel
resource
debian9-mipsel-en-20211208
resource tags

arch:mipselimage:debian9-mipsel-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
26-02-2023 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5b94360323d7ff9b34a591f424aed9c.elf
Size

156KB
MD5

b5b94360323d7ff9b34a591f424aed9c
SHA1

6c3afcbf59e43747167ce4c75cb902225f7ab338
SHA256

a4d7294a5884c13f0941d9363774e378852148c10859ea9151762282a6ab4000
SHA512

4900b3da0ebc27665df9d7736ba3a4b32f23338f68c3e987094f19b26c5753340d08650451e14e9aa905d5be2d4ad03473be885c6b525c8f99c44eaab3cad8f2
SSDEEP

1536:GoXeTy1OHivUetUuWsQhkjGy1lZRpCo1oN49kFK4pJ9wwwwwwaN7EEDF+teLM9ql:GoeiiKjG0ldSkNUQNrDF+tsM9qSX9bNi

Score

9^/10

Malware Config

Signatures

Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
/proc/21774/	/proc/21774/
/proc/33971/	/proc/33971/
/proc/47442/	/proc/47442/
/proc/53489/	/proc/53489/
/proc/63357/	/proc/63357/
/proc/91409/	/proc/91409/
/proc/53118/	/proc/53118/
/proc/55584/	/proc/55584/
/proc/66684/	/proc/66684/
/proc/7589/	/proc/7589/
/proc/10714/	/proc/10714/
/proc/21770/	/proc/21770/
/proc/24547/	/proc/24547/
/proc/51201/	/proc/51201/
/proc/36718/	/proc/36718/
/proc/53600/	/proc/53600/
/proc/67196/	/proc/67196/
/proc/27411/	/proc/27411/
/proc/28928/	/proc/28928/
/proc/69072/	/proc/69072/
/proc/72931/	/proc/72931/
/proc/74528/	/proc/74528/
/proc/3414/	/proc/3414/
/proc/12018/	/proc/12018/
/proc/33277/	/proc/33277/
/proc/40006/	/proc/40006/
/proc/72881/	/proc/72881/
/proc/31674/	/proc/31674/
/proc/50043/	/proc/50043/
/proc/75832/	/proc/75832/
/proc/90447/	/proc/90447/
/proc/97770/	/proc/97770/
/proc/5563/	/proc/5563/
/proc/6733/	/proc/6733/
/proc/11783/	/proc/11783/
/proc/71164/	/proc/71164/
/proc/15266/	/proc/15266/
/proc/15578/	/proc/15578/
/proc/28898/	/proc/28898/
/proc/39128/	/proc/39128/
/proc/48126/	/proc/48126/
/proc/4110/	/proc/4110/
/proc/11456/	/proc/11456/
/proc/17234/	/proc/17234/
/proc/18152/	/proc/18152/
/proc/27642/	/proc/27642/
/proc/41839/	/proc/41839/
/proc/53542/	/proc/53542/
/proc/71256/	/proc/71256/
/proc/84594/	/proc/84594/
/proc/92375/	/proc/92375/
/proc/97111/	/proc/97111/
/proc/41105/	/proc/41105/
/proc/41847/	/proc/41847/
/proc/48042/	/proc/48042/
/proc/51218/	/proc/51218/
/proc/52453/	/proc/52453/
/proc/55897/	/proc/55897/
/proc/64756/	/proc/64756/
/proc/2804/	/proc/2804/
/proc/43705/	/proc/43705/
/proc/54759/	/proc/54759/
/proc/31266/	/proc/31266/
/proc/32995/	/proc/32995/

/tmp/b5b94360323d7ff9b34a591f424aed9c.elf
/tmp/b5b94360323d7ff9b34a591f424aed9c.elf
1⤵
PID:332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads