Analysis
-
max time kernel
151s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20231222-en -
resource tags
-
submitted
03/02/2024, 02:48
General
-
Target
8bfbd5faf2dd2dfb76e60c14d010fbf1bcbe980950528709ceac4edc9f003c6a.elf
-
Size
215KB
-
MD5
8f0ef21b5de9e86fb84f39100d232d31
-
SHA1
dc251a7d8f85c9f22dcd88cdc1db553b2414837d
-
SHA256
8bfbd5faf2dd2dfb76e60c14d010fbf1bcbe980950528709ceac4edc9f003c6a
-
SHA512
2e2f07bddeaad98deef73b88054af5496dcf1dc5c716e31b92689601e939c535fc11eec69306755f29aed50f768ea09c3fc34967fb770d43df1f709a499ebf04
-
SSDEEP
6144:+dta8mHLmWskspb7HI+YnFavgBE6OCTI6c3m:+dta82xZAjsnwvgBE6OCTI6Wm
Malware Config
Signatures
-
Contacts a large (204549) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/8bfbd5faf2dd2dfb76e60c14d010fbf1bcbe980950528709ceac4edc9f003c6a.elf/tmp/8bfbd5faf2dd2dfb76e60c14d010fbf1bcbe980950528709ceac4edc9f003c6a.elf1⤵
- Creates/modifies Cron job