Analysis
-
max time kernel
151s -
max time network
146s -
platform
debian-9_armhf -
resource
debian9-armhf-20230831-en -
resource tags
arch:armhfimage:debian9-armhf-20230831-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
11-10-2023 11:16
Static task
static1
Behavioral task
behavioral1
Sample
a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3
Resource
debian9-armhf-20230831-en
General
-
Target
a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3
-
Size
78KB
-
MD5
9b6c3518a91d23ed77504b5416bfb5b3
-
SHA1
0a2d170abbf5031566377b01431e3b82d342630a
-
SHA256
a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3
-
SHA512
b2b08d5d5e6c6708d88b793e9340a780d47b5dce61e0a3026b4cdea8a9e4cbf9824037255e4ea4a40fee5bce956485232376d4677ce72ccb6c7f00badd09956e
-
SSDEEP
1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBht5:8D+CAXFYQChaAUk5ljnQssL
Malware Config
Signatures
-
Changes its process name 1 IoCs
Processes:
description ioc pid Changes the process name, possibly in an attempt to hide itself telnetd 364 -
Deletes itself 1 IoCs
Processes:
pid 364 -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3description ioc process File opened for modification /dev/watchdog a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3 File opened for modification /dev/misc/watchdog a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
Processes:
a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3description ioc process File opened for reading /proc/net/route a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3 -
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3description ioc process File opened for reading /proc/net/route a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3 File opened for reading /proc/net/tcp File opened for reading /proc/net/tcp6 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/365/fd File opened for reading /proc/315/cmdline File opened for reading /proc/315/fd File opened for reading /proc/241/fd File opened for reading /proc/29/cmdline File opened for reading /proc/22/cmdline File opened for reading /proc/26/cmdline File opened for reading /proc/24/cmdline File opened for reading /proc/364/fd File opened for reading /proc/244/fd File opened for reading /proc/241/cmdline File opened for reading /proc/135/cmdline File opened for reading /proc/106/cmdline File opened for reading /proc/42/cmdline File opened for reading /proc/7/cmdline File opened for reading /proc/222/cmdline File opened for reading /proc/107/cmdline File opened for reading /proc/28/cmdline File opened for reading /proc/318/cmdline File opened for reading /proc/130/fd File opened for reading /proc/16/cmdline File opened for reading /proc/6/cmdline File opened for reading /proc/3/cmdline File opened for reading /proc/2/cmdline File opened for reading /proc/161/cmdline File opened for reading /proc/143/cmdline File opened for reading /proc/21/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/365/cmdline File opened for reading /proc/289/cmdline File opened for reading /proc/246/cmdline File opened for reading /proc/12/cmdline File opened for reading /proc/138/cmdline File opened for reading /proc/104/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/362/cmdline File opened for reading /proc/358/cmdline File opened for reading /proc/283/fd File opened for reading /proc/288/cmdline File opened for reading /proc/25/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/288/fd File opened for reading /proc/283/cmdline File opened for reading /proc/244/cmdline File opened for reading /proc/240/fd File opened for reading /proc/43/cmdline File opened for reading /proc/27/cmdline File opened for reading /proc/364/cmdline File opened for reading /proc/361/cmdline File opened for reading /proc/137/cmdline File opened for reading /proc/74/cmdline File opened for reading /proc/18/cmdline File opened for reading /proc/4/cmdline File opened for reading /proc/246/fd File opened for reading /proc/95/cmdline File opened for reading /proc/11/cmdline File opened for reading /proc/359/cmdline File opened for reading /proc/319/cmdline File opened for reading /proc/161/fd File opened for reading /proc/13/cmdline File opened for reading /proc/8/cmdline File opened for reading /proc/1/cmdline File opened for reading /proc/319/fd -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
description ioc File opened for modification /tmp/fifo
Processes
-
/tmp/a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3/tmp/a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de31⤵
- Modifies Watchdog functionality
- Reads system routing table
- Reads system network configuration
-
/bin/sh/bin/sh -c "iptables -A INPUT -p tcp --destination-port 23 -j DROP"1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 23 -j DROP2⤵
-
/bin/sh/bin/sh -c "iptables -A INPUT -p tcp --destination-port 7547 -j DROP"1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 7547 -j DROP2⤵
-
/bin/sh/bin/sh -c "iptables -A INPUT -p tcp --destination-port 5555 -j DROP"1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 5555 -j DROP2⤵
-
/bin/sh/bin/sh -c "iptables -A INPUT -p tcp --destination-port 5358 -j DROP"1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 5358 -j DROP2⤵
-
/bin/sh/bin/sh -c "iptables -D INPUT -j CWMP_CR"1⤵
-
/sbin/iptablesiptables -D INPUT -j CWMP_CR2⤵
-
/bin/sh/bin/sh -c "iptables -X CWMP_CR"1⤵
-
/sbin/iptablesiptables -X CWMP_CR2⤵
-
/bin/sh/bin/sh -c "iptables -I INPUT -p udp --dport 35165 -j ACCEPT"1⤵
-
/sbin/iptablesiptables -I INPUT -p udp --dport 35165 -j ACCEPT2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/363-1-0x00010000-0x000506fc-memory.dmp