7621d1608c7e155bfd23dec8b8adf710ce30d0304e1e0a3c2240b6338ac098fe

Analysis

max time kernel
152s
max time network
154s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20230621-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20230621-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
24-07-2023 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c668ac6a5d75b41a3d9b3f0d23290fe9c41690043fa3cd533ee1c44b30c250c8.elf
Size

73KB
MD5

cf4261cce32c80773e92315fc754eaa1
SHA1

ab0f31a66c0da8500e3e5a47aff9ff0291c79c6e
SHA256

c668ac6a5d75b41a3d9b3f0d23290fe9c41690043fa3cd533ee1c44b30c250c8
SHA512

b9b29941a5cbe1a906191053c8e9e0b20f6b292462b2f511f29cf5b2fc5a033d77e86c58ecf30b448c8289ec71b360aceb1a0efe9f638649dd76b1d6651b329d
SSDEEP

1536:adObTH6V6vLoPzIgmRRG3daxhMpWhADv5o4W2UEGGFtRrbaiFhnh9lqP:xHyCLo7I/7G3WhMpWhAr5oMvVbFhnh94

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (113613) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	588	c668ac6a5d75b41a3d9b3f0d23290fe9c41690043fa3cd533ee1c44b30c250c8.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	c668ac6a5d75b41a3d9b3f0d23290fe9c41690043fa3cd533ee1c44b30c250c8.elf
File opened for modification	/dev/misc/watchdog	c668ac6a5d75b41a3d9b3f0d23290fe9c41690043fa3cd533ee1c44b30c250c8.elf

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/34/cmdline
File opened for reading	/proc/80/cmdline
File opened for reading	/proc/22/cmdline
File opened for reading	/proc/25/cmdline
File opened for reading	/proc/31/cmdline
File opened for reading	/proc/89/cmdline
File opened for reading	/proc/115/cmdline
File opened for reading	/proc/155/cmdline
File opened for reading	/proc/169/cmdline
File opened for reading	/proc/431/cmdline
File opened for reading	/proc/11/cmdline
File opened for reading	/proc/28/cmdline
File opened for reading	/proc/593/cmdline
File opened for reading	/proc/565/cmdline
File opened for reading	/proc/592/cmdline
File opened for reading	/proc/162/cmdline
File opened for reading	/proc/243/cmdline
File opened for reading	/proc/345/cmdline
File opened for reading	/proc/6/cmdline
File opened for reading	/proc/84/cmdline
File opened for reading	/proc/164/cmdline
File opened for reading	/proc/343/cmdline
File opened for reading	/proc/364/cmdline
File opened for reading	/proc/5/cmdline
File opened for reading	/proc/156/cmdline
File opened for reading	/proc/193/cmdline
File opened for reading	/proc/347/cmdline
File opened for reading	/proc/83/cmdline
File opened for reading	/proc/98/cmdline
File opened for reading	/proc/82/cmdline
File opened for reading	/proc/85/cmdline
File opened for reading	/proc/349/cmdline
File opened for reading	/proc/357/cmdline
File opened for reading	/proc/409/cmdline
File opened for reading	/proc/584/cmdline
File opened for reading	/proc/20/cmdline
File opened for reading	/proc/26/cmdline
File opened for reading	/proc/35/cmdline
File opened for reading	/proc/165/cmdline
File opened for reading	/proc/166/cmdline
File opened for reading	/proc/297/cmdline
File opened for reading	/proc/2/cmdline
File opened for reading	/proc/30/cmdline
File opened for reading	/proc/24/cmdline
File opened for reading	/proc/79/cmdline
File opened for reading	/proc/583/cmdline
File opened for reading	/proc/3/cmdline
File opened for reading	/proc/13/cmdline
File opened for reading	/proc/252/cmdline
File opened for reading	/proc/355/cmdline
File opened for reading	/proc/591/cmdline
File opened for reading	/proc/158/cmdline
File opened for reading	/proc/167/cmdline
File opened for reading	/proc/430/cmdline
File opened for reading	/proc/14/cmdline
File opened for reading	/proc/27/cmdline
File opened for reading	/proc/354/cmdline
File opened for reading	/proc/78/cmdline
File opened for reading	/proc/154/cmdline
File opened for reading	/proc/7/cmdline
File opened for reading	/proc/9/cmdline
File opened for reading	/proc/10/cmdline
File opened for reading	/proc/15/cmdline
File opened for reading	/proc/18/cmdline

/tmp/c668ac6a5d75b41a3d9b3f0d23290fe9c41690043fa3cd533ee1c44b30c250c8.elf
/tmp/c668ac6a5d75b41a3d9b3f0d23290fe9c41690043fa3cd533ee1c44b30c250c8.elf
1⤵
- Changes its process name
- Modifies Watchdog functionality
PID:588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads