Analysis
-
max time kernel
150s -
max time network
135s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
20-12-2023 08:34
Behavioral task
behavioral1
Sample
9630b58f33df07e45499c4b3eb652eec
Resource
debian9-armhf-20231215-en
General
-
Target
9630b58f33df07e45499c4b3eb652eec
-
Size
54KB
-
MD5
9630b58f33df07e45499c4b3eb652eec
-
SHA1
154428ecb8c91bffbab388acabef578ac8916719
-
SHA256
d3b42abea11d2459a24848d7861f491cebd0ec8cf1b14833e09e06e40324e2f8
-
SHA512
485fce45bf77ccbeffcfd7a14feac23aa31d10d305cafb2a11a4317617b22ce23617fff0b0800fd35c56be336597c049d0343c260c49aae606b153da7c18f449
-
SSDEEP
1536:6qRYWdHTrkurstqXmsFyjZzL+CCvwxRn8:D5TrnQtamsF8zi1X
Malware Config
Signatures
-
Contacts a large (10078) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
Processes:
9630b58f33df07e45499c4b3eb652eecdescription ioc pid process Changes the process name, possibly in an attempt to hide itself Sofia 653 9630b58f33df07e45499c4b3eb652eec -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
description ioc File opened for reading /proc/net/tcp -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/657/maps File opened for reading /proc/703/maps File opened for reading /proc/773/exe File opened for reading /proc/835/maps File opened for reading /proc/937/exe File opened for reading /proc/857/exe File opened for reading /proc/895/maps File opened for reading /proc/949/exe File opened for reading /proc/927/exe File opened for reading /proc/945/maps File opened for reading /proc/767/exe File opened for reading /proc/773/maps File opened for reading /proc/834/maps File opened for reading /proc/839/exe File opened for reading /proc/847/maps File opened for reading /proc/874/exe File opened for reading /proc/576/exe File opened for reading /proc/660/maps File opened for reading /proc/707/maps File opened for reading /proc/785/maps File opened for reading /proc/825/maps File opened for reading /proc/955/maps File opened for reading /proc/945/exe File opened for reading /proc/579/exe File opened for reading /proc/637/maps File opened for reading /proc/875/maps File opened for reading /proc/895/exe File opened for reading /proc/931/maps File opened for reading /proc/941/exe File opened for reading /proc/638/maps File opened for reading /proc/737/maps File opened for reading /proc/794/exe File opened for reading /proc/829/exe File opened for reading /proc/883/exe File opened for reading /proc/593/exe File opened for reading /proc/672/maps File opened for reading /proc/803/exe File opened for reading /proc/905/maps File opened for reading /proc/915/exe File opened for reading /proc/637/exe File opened for reading /proc/795/exe File opened for reading /proc/852/exe File opened for reading /proc/865/maps File opened for reading /proc/874/maps File opened for reading /proc/960/maps File opened for reading /proc/635/exe File opened for reading /proc/887/maps File opened for reading /proc/901/exe File opened for reading /proc/937/maps File opened for reading /proc/632/exe File opened for reading /proc/703/exe File opened for reading /proc/781/exe File opened for reading /proc/794/maps File opened for reading /proc/931/exe File opened for reading /proc/758/maps File opened for reading /proc/795/maps File opened for reading /proc/960/exe File opened for reading /proc/574/exe File opened for reading /proc/660/exe File opened for reading /proc/781/maps File opened for reading /proc/812/maps File opened for reading /proc/813/maps File opened for reading /proc/853/maps File opened for reading /proc/737/exe