190bf4e62e26ea5e20fc7d64890c388f221a1342ff374dc39b704af1b70b0772

Analysis

max time kernel
152s
max time network
155s
platform
linux_armhf
resource
debian9-armhf-en-20211208
resource tags

arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/10/2023, 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.NEASNEAS190bf4e62e26ea5e20fc7d64890c388f221a1342ff374dc39b704af1b70b0772elfelfelf_JC.elf
Size

193KB
MD5

bdc72c56f1569fb173908262c6d31861
SHA1

979ec04befef45079c027419ea3e41422fd33520
SHA256

190bf4e62e26ea5e20fc7d64890c388f221a1342ff374dc39b704af1b70b0772
SHA512

68f5d467ac8e31d22810124d098d03a18ff16e8ae328c8b48aee53bed27a776b2a5c7ca98170020c8a231569641fdfd146b460b094805ac40b198c43af807013
SSDEEP

6144:CUtcDtF0WQBB0abFymktTe77PCLyfJM/RfsmkjF:CUtcMBB0abFymktKPTfS/GR

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (55266) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself		359	NEAS.NEASNEAS190bf4e62e26ea5e20fc7d64890c388f221a1342ff374dc39b704af1b70b0772elfelfelf_JC.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc
File opened for modification	/sbin/watchdog
File opened for modification	/bin/watchdog

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/401/cmdline
File opened for reading	/proc/429/cmdline
File opened for reading	/proc/23/cmdline
File opened for reading	/proc/139/cmdline
File opened for reading	/proc/389/cmdline
File opened for reading	/proc/393/cmdline
File opened for reading	/proc/436/cmdline
File opened for reading	/proc/437/cmdline
File opened for reading	/proc/8/cmdline
File opened for reading	/proc/80/cmdline
File opened for reading	/proc/404/cmdline
File opened for reading	/proc/432/cmdline
File opened for reading	/proc/12/cmdline
File opened for reading	/proc/19/cmdline
File opened for reading	/proc/22/cmdline
File opened for reading	/proc/423/cmdline
File opened for reading	/proc/280/cmdline
File opened for reading	/proc/352/cmdline
File opened for reading	/proc/354/cmdline
File opened for reading	/proc/396/cmdline
File opened for reading	/proc/15/cmdline
File opened for reading	/proc/17/cmdline
File opened for reading	/proc/147/cmdline
File opened for reading	/proc/210/cmdline
File opened for reading	/proc/452/cmdline
File opened for reading	/proc/356/cmdline
File opened for reading	/proc/369/cmdline
File opened for reading	/proc/442/cmdline
File opened for reading	/proc/447/cmdline
File opened for reading	/proc/420/cmdline
File opened for reading	/proc/14/cmdline
File opened for reading	/proc/308/cmdline
File opened for reading	/proc/413/cmdline
File opened for reading	/proc/416/cmdline
File opened for reading	/proc/425/cmdline
File opened for reading	/proc/440/cmdline
File opened for reading	/proc/443/cmdline
File opened for reading	/proc/152/cmdline
File opened for reading	/proc/388/cmdline
File opened for reading	/proc/412/cmdline
File opened for reading	/proc/421/cmdline
File opened for reading	/proc/29/cmdline
File opened for reading	/proc/110/cmdline
File opened for reading	/proc/234/cmdline
File opened for reading	/proc/355/cmdline
File opened for reading	/proc/43/cmdline
File opened for reading	/proc/238/cmdline
File opened for reading	/proc/392/cmdline
File opened for reading	/proc/433/cmdline
File opened for reading	/proc/382/cmdline
File opened for reading	/proc/386/cmdline
File opened for reading	/proc/410/cmdline
File opened for reading	/proc/11/cmdline
File opened for reading	/proc/16/cmdline
File opened for reading	/proc/157/cmdline
File opened for reading	/proc/233/cmdline
File opened for reading	/proc/414/cmdline
File opened for reading	/proc/415/cmdline
File opened for reading	/proc/418/cmdline
File opened for reading	/proc/6/cmdline
File opened for reading	/proc/358/cmdline
File opened for reading	/proc/367/cmdline
File opened for reading	/proc/371/cmdline
File opened for reading	/proc/370/cmdline

/tmp/NEAS.NEASNEAS190bf4e62e26ea5e20fc7d64890c388f221a1342ff374dc39b704af1b70b0772elfelfelf_JC.elf
/tmp/NEAS.NEASNEAS190bf4e62e26ea5e20fc7d64890c388f221a1342ff374dc39b704af1b70b0772elfelfelf_JC.elf
1⤵
- Changes its process name
PID:359

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads