b346e55525cd26a8af6e819e57bf915b7388d8c1bf7de02c08721e656768bab7

Analysis

max time kernel
154s
max time network
156s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20230831-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20230831-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
11/10/2023, 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a2399175aee94f641d7ff8249ebf2d154a7925e5a4c2523e367149f4a3fb844.elf
Size

65KB
MD5

f367225d74f755b8cdd1b92f00b72e07
SHA1

717df671ffb22035ae02ffa49772fe9dcfc29c9c
SHA256

9a2399175aee94f641d7ff8249ebf2d154a7925e5a4c2523e367149f4a3fb844
SHA512

8245a2a3488e313e3d603e794b8f113743b2889af20427980c946f2256671fe90fda191850b7b89ba82e4956d882224f0e6eadb7bee688edb96fcb4b1de5f04f
SSDEEP

1536:/NFp7KQXRgoXRSEUV0wR56Q0X6P29V0RrSRGekCzOWl1noseaxshg4CUchSsd:1Fp7KQXRgoXRSEUV0wD6NqP29V0RTiOs

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (110807) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	587	9a2399175aee94f641d7ff8249ebf2d154a7925e5a4c2523e367149f4a3fb844.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	9a2399175aee94f641d7ff8249ebf2d154a7925e5a4c2523e367149f4a3fb844.elf
File opened for modification	/dev/misc/watchdog	9a2399175aee94f641d7ff8249ebf2d154a7925e5a4c2523e367149f4a3fb844.elf

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/14/cmdline
File opened for reading	/proc/27/cmdline
File opened for reading	/proc/170/cmdline
File opened for reading	/proc/408/cmdline
File opened for reading	/proc/584/cmdline
File opened for reading	/proc/21/cmdline
File opened for reading	/proc/89/cmdline
File opened for reading	/proc/338/cmdline
File opened for reading	/proc/9/cmdline
File opened for reading	/proc/20/cmdline
File opened for reading	/proc/163/cmdline
File opened for reading	/proc/421/cmdline
File opened for reading	/proc/18/cmdline
File opened for reading	/proc/25/cmdline
File opened for reading	/proc/30/cmdline
File opened for reading	/proc/113/cmdline
File opened for reading	/proc/165/cmdline
File opened for reading	/proc/363/cmdline
File opened for reading	/proc/590/cmdline
File opened for reading	/proc/23/cmdline
File opened for reading	/proc/28/cmdline
File opened for reading	/proc/29/cmdline
File opened for reading	/proc/154/cmdline
File opened for reading	/proc/160/cmdline
File opened for reading	/proc/167/cmdline
File opened for reading	/proc/242/cmdline
File opened for reading	/proc/591/cmdline
File opened for reading	/proc/36/cmdline
File opened for reading	/proc/156/cmdline
File opened for reading	/proc/343/cmdline
File opened for reading	/proc/344/cmdline
File opened for reading	/proc/410/cmdline
File opened for reading	/proc/4/cmdline
File opened for reading	/proc/32/cmdline
File opened for reading	/proc/80/cmdline
File opened for reading	/proc/81/cmdline
File opened for reading	/proc/192/cmdline
File opened for reading	/proc/307/cmdline
File opened for reading	/proc/564/cmdline
File opened for reading	/proc/6/cmdline
File opened for reading	/proc/19/cmdline
File opened for reading	/proc/251/cmdline
File opened for reading	/proc/155/cmdline
File opened for reading	/proc/3/cmdline
File opened for reading	/proc/26/cmdline
File opened for reading	/proc/85/cmdline
File opened for reading	/proc/162/cmdline
File opened for reading	/proc/423/cmdline
File opened for reading	/proc/22/cmdline
File opened for reading	/proc/24/cmdline
File opened for reading	/proc/84/cmdline
File opened for reading	/proc/116/cmdline
File opened for reading	/proc/2/cmdline
File opened for reading	/proc/7/cmdline
File opened for reading	/proc/11/cmdline
File opened for reading	/proc/13/cmdline
File opened for reading	/proc/78/cmdline
File opened for reading	/proc/82/cmdline
File opened for reading	/proc/128/cmdline
File opened for reading	/proc/157/cmdline
File opened for reading	/proc/161/cmdline
File opened for reading	/proc/340/cmdline
File opened for reading	/proc/350/cmdline
File opened for reading	/proc/583/cmdline

/tmp/9a2399175aee94f641d7ff8249ebf2d154a7925e5a4c2523e367149f4a3fb844.elf
/tmp/9a2399175aee94f641d7ff8249ebf2d154a7925e5a4c2523e367149f4a3fb844.elf
1⤵
- Changes its process name
- Modifies Watchdog functionality
PID:587

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads