f6c25d2b8841c74629e7b17de54caa7658a1b991e9b8c8bb3d89f3c19816ad6f

Analysis

max time kernel
10931s
max time network
133s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
18/03/2023, 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boatnet.arm7
Size

45KB
MD5

fb56a6197b3b9393d9b74b8cf6b2ba70
SHA1

3a5ec19828e9597a0408db6235b0e952ef94d964
SHA256

f6c25d2b8841c74629e7b17de54caa7658a1b991e9b8c8bb3d89f3c19816ad6f
SHA512

2001b0e26e1c0044784b838af48c7553863bdb799849e3138db001062ef3f48c37a9427dcc106d05b1e35c3b4d418893be0f3af49a4f097f2ac1cec98e232dd4
SSDEEP

768:g/TYCoIxdEk+AxoTZAZHFeq8b359q3UELbUXfi6nVMQHI4vcGpv9:gECFd+A6YHAxsLRQZ9

Score

9^/10

Malware Config

Signatures

Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc
/bin/watchdog	/bin/watchdog
/sbin/watchdog	/sbin/watchdog

Reads runtime system information 20 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/456/cmdline	/proc/456/cmdline	Process not Found
/proc/498/cmdline	/proc/498/cmdline	Process not Found
/proc/496/cmdline	/proc/496/cmdline	Process not Found
/proc/497/cmdline	/proc/497/cmdline	Process not Found
/proc/416/cmdline	/proc/416/cmdline	Process not Found
/proc/441/cmdline	/proc/441/cmdline	Process not Found
/proc/486/cmdline	/proc/486/cmdline	Process not Found
/proc/422/cmdline	/proc/422/cmdline	Process not Found
/proc/431/cmdline	/proc/431/cmdline	Process not Found
/proc/451/cmdline	/proc/451/cmdline	Process not Found
/proc/452/cmdline	/proc/452/cmdline	Process not Found
/proc/476/cmdline	/proc/476/cmdline	Process not Found
/proc/self/exe	/proc/self/exe	boatnet.arm7
/proc/	/proc/	Process not Found
/proc/401/cmdline	/proc/401/cmdline	Process not Found
/proc/464/cmdline	/proc/464/cmdline	Process not Found
/proc/468/cmdline	/proc/468/cmdline	Process not Found
/proc/417/cmdline	/proc/417/cmdline	Process not Found
/proc/419/cmdline	/proc/419/cmdline	Process not Found
/proc/432/cmdline	/proc/432/cmdline	Process not Found

/tmp/boatnet.arm7
/tmp/boatnet.arm7
1⤵
- Reads runtime system information
PID:364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads