Overview

overview

10

Static

static

10

189ca1951e...df.exe

windows7-x64

10

189ca1951e...df.exe

windows10-2004-x64

10

37ca1cfa1f...60.exe

windows7-x64

10

37ca1cfa1f...60.exe

windows10-2004-x64

10

37e3ba3283...c3.elf

debian-9-armhf

1

3898dfa5cb...ba.exe

windows7-x64

10

3898dfa5cb...ba.exe

windows10-2004-x64

10

3e488cd6f6...e9.exe

windows7-x64

10

3e488cd6f6...e9.exe

windows10-2004-x64

10

505fe3cf69...cb.exe

windows7-x64

10

505fe3cf69...cb.exe

windows10-2004-x64

10

6543c547b8...84.exe

windows7-x64

1

6543c547b8...84.exe

windows10-2004-x64

10

911bb31927...e4.exe

windows7-x64

10

911bb31927...e4.exe

windows10-2004-x64

10

913aec7dc7...60.exe

windows7-x64

10

913aec7dc7...60.exe

windows10-2004-x64

10

NEAS.arm7elf_JC.elf

debian-9-armhf

1

a23543464a...48.exe

windows7-x64

10

a23543464a...48.exe

windows10-2004-x64

10

ad21aff38e...59.exe

windows7-x64

1

ad21aff38e...59.exe

windows10-2004-x64

10

ba5ce65d72...ff.exe

windows7-x64

10

ba5ce65d72...ff.exe

windows10-2004-x64

10

ca1af61fd2...7f.elf

debian-9-mipsel

9

cad291a2df...eb.exe

windows7-x64

10

cad291a2df...eb.exe

windows10-2004-x64

10

da8e7392c3...fb.exe

windows7-x64

10

da8e7392c3...fb.exe

windows10-2004-x64

10

e3a0367cf2...02.exe

windows7-x64

10

e3a0367cf2...02.exe

windows10-2004-x64

10

f8ac9d00a1...1b.exe

windows7-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    160s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20230831-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20230831-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    07-10-2023 08:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ca1af61fd2c6ecd3827b63604900beaaf6382c8bf6ef6b7a6e469e250f9b2e7f.elf

  • Size

    74KB

  • MD5

    7712622b406f7bbf8ba62a28e1e35158

  • SHA1

    eb5fdd089b82ed7634965f6569eeb6c5302b5a71

  • SHA256

    ca1af61fd2c6ecd3827b63604900beaaf6382c8bf6ef6b7a6e469e250f9b2e7f

  • SHA512

    f410834285c2d6f3642eb758a6ac6fc94acf610d853cedc2c6c129f8bcd51b6bcf87d814df9919329179a706c999c92570c6642bc9168af1c3d036fea64c98b2

  • SSDEEP

    1536:znTcO2ULJEAnDrRSWHQLgTPoMgr3d4MXRPd:zTD2ULJEApUiM

Score
9/10
discovery

Malware Config

Signatures

  • Contacts a large (137941) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Changes its process name 1 IoCs
  • Deletes itself 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Unexpected DNS network traffic destination 13 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/ca1af61fd2c6ecd3827b63604900beaaf6382c8bf6ef6b7a6e469e250f9b2e7f.elf
    /tmp/ca1af61fd2c6ecd3827b63604900beaaf6382c8bf6ef6b7a6e469e250f9b2e7f.elf
    1⤵
    • Changes its process name
    • Deletes itself
    • Modifies Watchdog functionality
    PID:339

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads