107faafdfa59a434e8b0bd20e5e2e68c6b313ef872b0c949962de53e402d6084

Analysis

max time kernel
150s
max time network
7s
platform
debian-9_mips
resource
debian9-mipsbe-20231222-en
resource tags

arch:mipsimage:debian9-mipsbe-20231222-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
12-02-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

107faafdfa59a434e8b0bd20e5e2e68c6b313ef872b0c949962de53e402d6084.elf
Size

70KB
MD5

dd98595d5e03f5ecedd69ba4c3229dda
SHA1

7a6dabbda972d075230774fc9a26b45379a51775
SHA256

107faafdfa59a434e8b0bd20e5e2e68c6b313ef872b0c949962de53e402d6084
SHA512

937aec3ebfa153e64f96c127c8eda0b886d762ec5bfee27802c73a3ea10c7e3e74f4ad1c6dc89d9aa2d8a29c0a933e4a483e0f87829b13616768e02d64f06146
SSDEEP

1536:YfaPVPXyGxOaXQp4H8fIJgnIP1um/zPMXU:/BRXusWIP1umrP8U

Score

7^/10

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc
File opened for modification	/bin/watchdog
File opened for modification	/sbin/watchdog

Reads runtime system information 22 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/712/cmdline
File opened for reading	/proc/713/cmdline
File opened for reading	/proc/715/cmdline
File opened for reading	/proc/808/cmdline
File opened for reading	/proc/433/cmdline
File opened for reading	/proc/671/cmdline
File opened for reading	/proc/673/cmdline
File opened for reading	/proc/674/cmdline
File opened for reading	/proc/722/cmdline
File opened for reading	/proc/784/cmdline
File opened for reading	/proc/792/cmdline
File opened for reading	/proc/718/cmdline
File opened for reading	/proc/735/cmdline
File opened for reading	/proc/767/cmdline
File opened for reading	/proc/780/cmdline
File opened for reading	/proc/781/cmdline
File opened for reading	/proc/668/cmdline
File opened for reading	/proc/699/cmdline
File opened for reading	/proc/719/cmdline
File opened for reading	/proc/732/cmdline
File opened for reading	/proc/782/cmdline
File opened for reading	/proc/825/cmdline

/tmp/107faafdfa59a434e8b0bd20e5e2e68c6b313ef872b0c949962de53e402d6084.elf
/tmp/107faafdfa59a434e8b0bd20e5e2e68c6b313ef872b0c949962de53e402d6084.elf
1⤵
PID:728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads