040a656ed2944cca98b21c85f3536a8c55a4f2ddd16fa6ed95a7069d41375e58

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20231222-en
resource tags

arch:armhfimage:debian9-armhf-20231222-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20/02/2024, 03:40 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8d291edf226dc928a9ccef9956832d61a65b6eec346a2be35a9cb7f3ce12379.elf
Size

62KB
MD5

ca003adee80a69a3dc3ac0b699b81b7e
SHA1

da9a817b3cdf1759510cedf33a65214bba56f590
SHA256

b8d291edf226dc928a9ccef9956832d61a65b6eec346a2be35a9cb7f3ce12379
SHA512

1ab719dab038d38fb036137ca640af0a28cd23bfc665ad98c743f2553d5b2049fa87f2f4ae9c82f85ead8471a2f76426e2988888c6d26ff207aeb64f8e982be2
SSDEEP

768:R3nEczUZzYHTg13Je1t0zYRx0v6zJpbLA57MQHiLwCVy/Jx+5H8hG1rmCd/574yN:ZEFZyTg61tsYJLA54JeZWnxCBf

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (40905) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 IoCs

pid	Process
640	b8d291edf226dc928a9ccef9956832d61a65b6eec346a2be35a9cb7f3ce12379.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

Enumerates active TCP sockets 1 TTPs 2 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	b8d291edf226dc928a9ccef9956832d61a65b6eec346a2be35a9cb7f3ce12379.elf
File opened for reading	/proc/net/tcp	Process not Found

Enumerates running processes
Discovers information about currently running processes on the system

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/tcp	b8d291edf226dc928a9ccef9956832d61a65b6eec346a2be35a9cb7f3ce12379.elf
File opened for reading	/proc/net/tcp	Process not Found

Reads runtime system information 56 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/626/fd
File opened for reading	/proc/765/exe
File opened for reading	/proc/782/exe
File opened for reading	/proc/790/exe
File opened for reading	/proc/262/fd
File opened for reading	/proc/633/fd
File opened for reading	/proc/643/fd
File opened for reading	/proc/305/fd
File opened for reading	/proc/199/fd
File opened for reading	/proc/576/fd
File opened for reading	/proc/644/fd
File opened for reading	/proc/772/exe
File opened for reading	/proc/774/exe
File opened for reading	/proc/134/fd
File opened for reading	/proc/632/fd
File opened for reading	/proc/575/fd
File opened for reading	/proc/297/fd
File opened for reading	/proc/763/exe
File opened for reading	/proc/264/fd
File opened for reading	/proc/661/fd
File opened for reading	/proc/639/exe
File opened for reading	/proc/788/exe
File opened for reading	/proc/570/fd
File opened for reading	/proc/667/fd
File opened for reading	/proc/573/exe
File opened for reading	/proc/632/exe
File opened for reading	/proc/761/exe
File opened for reading	/proc/648/fd
File opened for reading	/proc/570/exe
File opened for reading	/proc/684/exe
File opened for reading	/proc/770/exe
File opened for reading	/proc/645/fd
File opened for reading	/proc/309/fd
File opened for reading	/proc/644/exe
File opened for reading	/proc/778/exe
File opened for reading	/proc/295/fd
File opened for reading	/proc/659/fd
File opened for reading	/proc/659/exe
File opened for reading	/proc/590/exe
File opened for reading	/proc/776/exe
File opened for reading	/proc/261/fd
File opened for reading	/proc/647/fd
File opened for reading	/proc/575/exe
File opened for reading	/proc/636/exe
File opened for reading	/proc/780/exe
File opened for reading	/proc/1/fd
File opened for reading	/proc/573/fd
File opened for reading	/proc/638/exe
File opened for reading	/proc/258/fd
File opened for reading	/proc/590/fd
File opened for reading	/proc/784/exe
File opened for reading	/proc/786/exe
File opened for reading	/proc/279/fd
File opened for reading	/proc/576/exe
File opened for reading	/proc/670/exe
File opened for reading	/proc/169/fd

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/b8d291edf226dc928a9ccef9956832d61a65b6eec346a2be35a9cb7f3ce12379.elf	b8d291edf226dc928a9ccef9956832d61a65b6eec346a2be35a9cb7f3ce12379.elf

/tmp/b8d291edf226dc928a9ccef9956832d61a65b6eec346a2be35a9cb7f3ce12379.elf
/tmp/b8d291edf226dc928a9ccef9956832d61a65b6eec346a2be35a9cb7f3ce12379.elf
1⤵
- Deletes itself
- Enumerates active TCP sockets
- Reads system network configuration
- Writes file to tmp directory
PID:640