93a38d162963f62c93e3b840ae45a36486284759a50e998cdc581a943bf31c7f

Analysis

max time kernel
153s
max time network
157s
platform
debian-9_armhf
resource
debian9-armhf-20231215-en
resource tags

arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20-12-2023 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dab4dac2b3325edd653ecaa7c50bc878
Size

42KB
MD5

dab4dac2b3325edd653ecaa7c50bc878
SHA1

4ddf95808ecf5251664ec60b199fc549a51cf2fc
SHA256

93a38d162963f62c93e3b840ae45a36486284759a50e998cdc581a943bf31c7f
SHA512

09151b0cf74e44bf3a21e3f3b9390c156f00b28ce194111da747197f55fa6b4191267d306184f7c3c857ad4e6b2c95d43c9996aa4adc656fd2c08033ca769c28
SSDEEP

768:2Y1fDD+IgMByk4Rdikux7MUFrkeQPn3XiPhR5gNOZYWqcx6:bfDD+rI4Rdwx5rP4nipRLT7

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (57443) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

Processes:

dab4dac2b3325edd653ecaa7c50bc878

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	669	dab4dac2b3325edd653ecaa7c50bc878

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

Processes:

description	ioc
File opened for modification	/sbin/watchdog
File opened for modification	/bin/watchdog

/tmp/dab4dac2b3325edd653ecaa7c50bc878
/tmp/dab4dac2b3325edd653ecaa7c50bc878
1⤵
- Changes its process name
PID:669

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads