Analysis
-
max time kernel
151s -
max time network
154s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
resource tags
arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
19-06-2023 08:22
Behavioral task
behavioral1
Sample
78f2363bef1d7ad993b403fbebab2aa0.elf
Resource
debian9-armhf-en-20211208
General
-
Target
78f2363bef1d7ad993b403fbebab2aa0.elf
-
Size
128KB
-
MD5
78f2363bef1d7ad993b403fbebab2aa0
-
SHA1
da6c73887d88b8b4b79359172c4cff3ac9566e6c
-
SHA256
301fabc381411225889f33942e46ac0b70c3c9f37bfe9108271d2614deca3938
-
SHA512
9c630e872f903f0fa4cb3b54e805d1fc039d9e6b64bada2e26dfbcb68d2e18423ebb3771e094d13f2ecb9a346a87894a8ea15dffab5783fc46956609532dabc0
-
SSDEEP
3072:5MHPp2YD4jM82uSHfFBIFKFbwegZS9j6RM/96mywPoIlq:5MHPp2tjkuSHfFBMKO5S98M/96mywPo1
Malware Config
Signatures
-
Contacts a large (49511) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
Processes:
78f2363bef1d7ad993b403fbebab2aa0.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself ay9xr8wytecp1twtif2a 351 78f2363bef1d7ad993b403fbebab2aa0.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Writes file to system bin folder 1 TTPs 1 IoCs