Overview

overview

10

Static

static

10

aa5f984e65...c7.elf

debian-9-mips

9

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    linux_mips
  • resource
    debian9-mipsbe-en-20211208
  • resource tags

    arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    20/04/2023, 05:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    aa5f984e65f40f9d1b4346e0e63216c7.elf

  • Size

    82KB

  • MD5

    aa5f984e65f40f9d1b4346e0e63216c7

  • SHA1

    8946a730d5042afb06968a43e60bc2c14f7cb806

  • SHA256

    218fe9da113b9452350786c8666d471949058ca172f0e2e56a5503f0f988f1dd

  • SHA512

    cadcc7e3e44b5d6ad1c18051ad04f8fd02329b3dc8486f039de609c9a32800055d1daab0ed9a386c97f07ddac2a83b4d25d1ad89dcb12ac4013fcce238899cd9

  • SSDEEP

    768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UT+7ZDYovZ73x/nL8y8Q4:Rakdn2Eo3ePu5GT+RYo99Be037Wt/

Score
9/10
discovery

Malware Config

Signatures

  • Contacts a large (34808) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/aa5f984e65f40f9d1b4346e0e63216c7.elf
    /tmp/aa5f984e65f40f9d1b4346e0e63216c7.elf
    1⤵
      PID:324
    • /bin/sh
      sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/aa5f984e65f40f9d1b4346e0e63216c7.elf bin/watchdog; chmod 777 bin/watchdog"
      1⤵
        PID:325
        • /bin/rm
          rm -rf bin/watchdog
          2⤵
            PID:326
          • /bin/mkdir
            mkdir bin
            2⤵
            • Reads runtime system information
            PID:327
          • /bin/mv
            mv /tmp/aa5f984e65f40f9d1b4346e0e63216c7.elf bin/watchdog
            2⤵
            • Reads runtime system information
            PID:328
          • /bin/chmod
            chmod 777 bin/watchdog
            2⤵
              PID:329

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads