e1f05ca9b9a4a7846bb18bb2538353be82f6d33960f6de61b8866f55c15d9e1a

Analysis

max time kernel
84s
max time network
103s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
03/10/2023, 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1f05ca9b9a4a7846bb18bb2538353be82f6d33960f6de61b8866f55c15d9e1a_JC.elf
Size

52KB
MD5

604897a9208489fd3d564262009299fc
SHA1

671bb0c6277a11f098bfbd207d211768f886a43f
SHA256

e1f05ca9b9a4a7846bb18bb2538353be82f6d33960f6de61b8866f55c15d9e1a
SHA512

3cd1bc2f7a033a3cd85cb10a7921f8c31d1056ee3367e8cc733164b5be04a9e6341d9bae76600e13456d73c71be75ce59ddc5ae957aa27c3580521ee8958b02a
SSDEEP

1536:MduFCOS1Kks1r3+qaEbSZgKkcQJS88IIH:BF7vks1r39agSRQq

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
581	e1f05ca9b9a4a7846bb18bb2538353be82f6d33960f6de61b8866f55c15d9e1a_JC.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc	Process
File opened for modification	/etc/resolv.conf	e1f05ca9b9a4a7846bb18bb2538353be82f6d33960f6de61b8866f55c15d9e1a_JC.elf

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/6/cmdline
File opened for reading	/proc/7/cmdline
File opened for reading	/proc/8/cmdline
File opened for reading	/proc/9/cmdline
File opened for reading	/proc/2/cmdline
File opened for reading	/proc/3/cmdline
File opened for reading	/proc/4/cmdline
File opened for reading	/proc/5/cmdline

/tmp/e1f05ca9b9a4a7846bb18bb2538353be82f6d33960f6de61b8866f55c15d9e1a_JC.elf
/tmp/e1f05ca9b9a4a7846bb18bb2538353be82f6d33960f6de61b8866f55c15d9e1a_JC.elf
1⤵
- Deletes itself
- Writes DNS configuration
PID:581

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Dynamic Resolution

T1568

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...