Analysis
-
max time kernel
146s -
max time network
134s -
platform
debian-9_armhf -
resource
debian9-armhf-20231222-en -
resource tags
-
submitted
09/01/2024, 03:17
General
-
Target
23d0db910afaf3f6e17f79fa929f637c1482cda00e3ad4bf0448e9535154bd6e.elf
-
Size
126KB
-
MD5
b67102d06208af0e95b933ace102606b
-
SHA1
a717d42c8acc546976f85fcd2076f8b7077621f8
-
SHA256
23d0db910afaf3f6e17f79fa929f637c1482cda00e3ad4bf0448e9535154bd6e
-
SHA512
ca1242d84d30310af2ffc027cf7d46917bc05f798498cdc400c5288f5ab8d9414b3fce948fb18696145ef734840c795aaf0478d6a84a2ddb40618ff83c337b68
-
SSDEEP
3072:6jVlyaL5JCrIpv04sIbttiEiTmP46aQyfPlfKsNb:yoCJCN4sIbHemP46aQyfPlfKsNb
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/23d0db910afaf3f6e17f79fa929f637c1482cda00e3ad4bf0448e9535154bd6e.elf/tmp/23d0db910afaf3f6e17f79fa929f637c1482cda00e3ad4bf0448e9535154bd6e.elf1⤵
- Changes its process name
- Reads system routing table
- Reads system network configuration