Overview

overview

7

Static

static

7

91942f5b16...df.elf

debian-9-armhf

7

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20231222-en
  • resource tags

    arch:armhfimage:debian9-armhf-20231222-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    13/02/2024, 03:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    91942f5b16d7ba715a796febdce49d0eb2c4850910a807ed78005336b3d5afdf.elf

  • Size

    59KB

  • MD5

    0633df94906121f546d6df8970ed58ae

  • SHA1

    a93f1cd423605322a0bb2850615a0fe5aea1b3a0

  • SHA256

    91942f5b16d7ba715a796febdce49d0eb2c4850910a807ed78005336b3d5afdf

  • SHA512

    09364f5f541642af65a9fcd2825fd1b9c30478f5e177965692f63aa8f4a88518e5b2a7a1ce7e7a4636c1e0551be0e49659bfc8d40e2d9a2fd6f7220f50086b60

  • SSDEEP

    1536:gTlheJ5bdegbnBoSAs3dULQvQ4r5G1rqkS+WM/j:ZP3bnBoBs+LuSlj

Score
7/10

Malware Config

Signatures

  • Flushes firewall rules 4 IoCs

    Flushes/ disables firewall rules inside the Linux kernel.

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Writes DNS configuration 1 TTPs 1 IoCs

    Writes data to DNS resolver config file.

  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/91942f5b16d7ba715a796febdce49d0eb2c4850910a807ed78005336b3d5afdf.elf
    /tmp/91942f5b16d7ba715a796febdce49d0eb2c4850910a807ed78005336b3d5afdf.elf
    1⤵
    • Writes DNS configuration
    • Reads runtime system information
    PID:699
  • /sbin/iptables
    iptables -P INPUT ACCEPT
    1⤵
      PID:703
    • /sbin/iptables
      iptables -P FORWARD ACCEPT
      1⤵
        PID:707
      • /sbin/iptables
        iptables -P OUTPUT ACCEPT
        1⤵
          PID:708
        • /sbin/iptables
          iptables -t nat -F
          1⤵
          • Flushes firewall rules
          PID:711
        • /sbin/iptables
          iptables -t mangle -F
          1⤵
          • Flushes firewall rules
          PID:721
        • /sbin/iptables
          iptables -F
          1⤵
          • Flushes firewall rules
          PID:725
        • /sbin/iptables
          iptables -X
          1⤵
          • Flushes firewall rules
          PID:726

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads