ae5dfd046a1caf394990dedd919fc8dd85368080a92ef5b981ef3500df94254a

Analysis

max time kernel
142s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20-12-2023 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d992b35aaa9d1ab212314b133179ed1
Size

54KB
MD5

8d992b35aaa9d1ab212314b133179ed1
SHA1

b2f7c0510eea82d59482c6ad945e4cad27a9c8bb
SHA256

ae5dfd046a1caf394990dedd919fc8dd85368080a92ef5b981ef3500df94254a
SHA512

9ec10eb01da5dd24fc8093db8a018ff26c3a3dc48bd986ec2c3233989d34448753bdecc81e81500a3ee67fff3d3f862c47de5c0b525a677845aeb39703cfb84d
SSDEEP

1536:jw7AeMYn/OY8R3bW/gbDF5+dKOTwTlIOJ+FbnrURYf:jkAeMYeR3bssDFgdKDTnoBCYf

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (2733) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Processes:

description ioc

File opened for modification /dev/watchdog
File opened for modification /dev/misc/watchdog
Enumerates running processes
Discovers information about currently running processes on the system
Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow
T1574

Processes:

description ioc

File opened for modification /sbin/watchdog
File opened for modification /bin/watchdog

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

description	ioc
File opened for modification	/sbin/watchdog
File opened for modification	/bin/watchdog

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
File opened for reading	/proc/15/maps
File opened for reading	/proc/1106/maps
File opened for reading	/proc/23/exe
File opened for reading	/proc/115/cmdline
File opened for reading	/proc/1257/maps
File opened for reading	/proc/28/exe
File opened for reading	/proc/702/exe
File opened for reading	/proc/1049/cmdline
File opened for reading	/proc/18/maps
File opened for reading	/proc/166/maps
File opened for reading	/proc/1366/maps
File opened for reading	/proc/169/exe
File opened for reading	/proc/1238/maps
File opened for reading	/proc/1343/maps
File opened for reading	/proc/10/exe
File opened for reading	/proc/78/cmdline
File opened for reading	/proc/81/maps
File opened for reading	/proc/19/maps
File opened for reading	/proc/1178/cmdline
File opened for reading	/proc/1492/cmdline
File opened for reading	/proc/9/exe
File opened for reading	/proc/21/exe
File opened for reading	/proc/156/cmdline
File opened for reading	/proc/1110/maps
File opened for reading	/proc/1122/exe
File opened for reading	/proc/1510/maps
File opened for reading	/proc/16/maps
File opened for reading	/proc/164/cmdline
File opened for reading	/proc/436/maps
File opened for reading	/proc/173/cmdline
File opened for reading	/proc/561/cmdline
File opened for reading	/proc/947/exe
File opened for reading	/proc/85/exe
File opened for reading	/proc/158/exe
File opened for reading	/proc/1054/cmdline
File opened for reading	/proc/1/cmdline
File opened for reading	/proc/932/exe
File opened for reading	/proc/1032/cmdline
File opened for reading	/proc/582/exe
File opened for reading	/proc/1168/exe
File opened for reading	/proc/17/maps
File opened for reading	/proc/81/cmdline
File opened for reading	/proc/523/exe
File opened for reading	/proc/24/maps
File opened for reading	/proc/317/maps
File opened for reading	/proc/1092/maps
File opened for reading	/proc/1237/cmdline
File opened for reading	/proc/1297/exe
File opened for reading	/proc/82/cmdline
File opened for reading	/proc/159/cmdline
File opened for reading	/proc/1052/maps
File opened for reading	/proc/711/maps
File opened for reading	/proc/711/exe
File opened for reading	/proc/1068/cmdline
File opened for reading	/proc/1277/maps
File opened for reading	/proc/4/cmdline
File opened for reading	/proc/23/cmdline
File opened for reading	/proc/198/cmdline
File opened for reading	/proc/430/maps
File opened for reading	/proc/434/maps
File opened for reading	/proc/1049/exe
File opened for reading	/proc/164/exe
File opened for reading	/proc/953/exe
File opened for reading	/proc/1523/maps

/tmp/8d992b35aaa9d1ab212314b133179ed1
/tmp/8d992b35aaa9d1ab212314b133179ed1
1⤵
PID:1514

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Impair Defenses

T1562

Hijack Execution Flow

T1574

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads