Analysis
-
max time kernel
1s -
max time network
28s -
platform
debian-9_mips -
resource
debian9-mipsbe-20231222-en -
resource tags
arch:mipsimage:debian9-mipsbe-20231222-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
08/01/2024, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
1e813727174a3135165ef0fa74664f5305527c64a5a52da61bcfa30f8053373d.elf
Resource
debian9-mipsbe-20231222-en
General
-
Target
1e813727174a3135165ef0fa74664f5305527c64a5a52da61bcfa30f8053373d.elf
-
Size
98KB
-
MD5
ce006232d9983334aead018d7ae064de
-
SHA1
a4f029dba18263c08a8f6225017e023840a25daf
-
SHA256
1e813727174a3135165ef0fa74664f5305527c64a5a52da61bcfa30f8053373d
-
SHA512
1f59307e9ec0ac0c6e4dde6a2626a02237d39890b27bfd3b065b856948fcbb25a72ac75fd87142272f7a8135b0607394ad0b358d9ef257d0d5533d6abab862c7
-
SSDEEP
1536:pxv8kk3+je7JiMNN96M967v96Mdy+kJ2cXborlekZqzsA:7kkk36e7BD+kJvr+uzsA
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /var/Sofia 708 1e813727174a3135165ef0fa74664f5305527c64a5a52da61bcfa30f8053373d.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 1e813727174a3135165ef0fa74664f5305527c64a5a52da61bcfa30f8053373d.elf File opened for modification /dev/misc/watchdog 1e813727174a3135165ef0fa74664f5305527c64a5a52da61bcfa30f8053373d.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/10/stat File opened for reading /proc/6/stat File opened for reading /proc/8/cmdline File opened for reading /proc/12/cmdline File opened for reading /proc/16/fd File opened for reading /proc/17/cmdline File opened for reading /proc/36/fd File opened for reading /proc/80/stat File opened for reading /proc/3/fd File opened for reading /proc/20/stat File opened for reading /proc/36/cmdline File opened for reading /proc/9/fd File opened for reading /proc/72/stat File opened for reading /proc/20/cmdline File opened for reading /proc/79/cmdline File opened for reading /proc/12/fd File opened for reading /proc/21/stat File opened for reading /proc/24/cmdline File opened for reading /proc/18/fd File opened for reading /proc/17/fd File opened for reading /proc/19/cmdline File opened for reading /proc/21/fd File opened for reading /proc/37/cmdline File opened for reading /proc/70/stat File opened for reading /proc/74/cmdline File opened for reading /proc/16/stat File opened for reading /proc/22/fd File opened for reading /proc/74/stat File opened for reading /proc/81/fd File opened for reading /proc/4/fd File opened for reading /proc/2/cmdline File opened for reading /proc/6/fd File opened for reading /proc/7/stat File opened for reading /proc/7/fd File opened for reading /proc/18/cmdline File opened for reading /proc/37/fd File opened for reading /proc/70/fd File opened for reading /proc/75/stat File opened for reading /proc/5/cmdline File opened for reading /proc/23/fd File opened for reading /proc/77/fd File opened for reading /proc/5/stat File opened for reading /proc/11/fd File opened for reading /proc/15/cmdline File opened for reading /proc/75/fd File opened for reading /proc/76/stat File opened for reading /proc/105/cmdline File opened for reading /proc/9/stat File opened for reading /proc/80/fd File opened for reading /proc/81/stat File opened for reading /proc/14/cmdline File opened for reading /proc/18/stat File opened for reading /proc/22/stat File opened for reading /proc/23/cmdline File opened for reading /proc/74/fd File opened for reading /proc/76/fd File opened for reading /proc/77/stat File opened for reading /proc/8/stat File opened for reading /proc/6/cmdline File opened for reading /proc/19/fd File opened for reading /proc/4/stat File opened for reading /proc/24/stat File opened for reading /proc/71/stat File opened for reading /proc/71/cmdline