7a38e83cbed48b11ecbe065088224203208122797fe4a609e20d7853fd60c98c

Analysis

max time kernel
149s
max time network
148s
platform
debian-9_mips
resource
debian9-mipsbe-20221125-en
resource tags

arch:mipsimage:debian9-mipsbe-20221125-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
09/07/2023, 07:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60971b6b2247d3f521a0918b4.elf
Size

82KB
MD5

60971b6b2247d3f521a0918b421642ec
SHA1

862c65c2e8c8a7f55e46ce7438b5440aa43ddbd7
SHA256

7a38e83cbed48b11ecbe065088224203208122797fe4a609e20d7853fd60c98c
SHA512

aa491f72d0df21cdefc1c036a76f2a8666ab3b654f4a20c6662b3fc68c3d850715ca8a1c6f6686a948383c3c6cac73e866a645ed7f98cbfa39b5e7a8c8acf23c
SSDEEP

1536:MQnOFmg1zaF1xh7hV6cBxImB15DX4q7zjw/lrlAVBMIZ:7OFmg1zkxhP6cVB15DXpzjFLF

Score

7^/10

Malware Config

Signatures

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	325	60971b6b2247d3f521a0918b4.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/401/maps
File opened for reading	/proc/405/maps

/tmp/60971b6b2247d3f521a0918b4.elf
/tmp/60971b6b2247d3f521a0918b4.elf
1⤵
- Changes its process name
PID:325

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads