Analysis
-
max time kernel
149s -
max time network
4s -
platform
debian-9_armhf -
resource
debian9-armhf-20240221-en -
resource tags
arch:armhfimage:debian9-armhf-20240221-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
22-02-2024 06:04
Behavioral task
behavioral1
Sample
98e8e0db973bc25a314918fb3065778f16821978fd9dbbf067ead453b4ad8b00.elf
Resource
debian9-armhf-20240221-en
General
-
Target
98e8e0db973bc25a314918fb3065778f16821978fd9dbbf067ead453b4ad8b00.elf
-
Size
126KB
-
MD5
633c252c023b0756d7d5740d2f44fe5e
-
SHA1
cfffad391d27ba3c270b9ee9de74d998ec9c9616
-
SHA256
98e8e0db973bc25a314918fb3065778f16821978fd9dbbf067ead453b4ad8b00
-
SHA512
ebbafb6093090ecba1cfeed38ee945dad2a2fc8ed4ff64670d02dfdacde1f622534f406d8349a89a4822f14a4ca41c8ac5081711d705ffcebba0afbf77045a92
-
SSDEEP
3072:cowpuQyNSG2eRa1styK9flTQPHoWrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIWrSmM/9nd
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 27 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/593/cmdline File opened for reading /proc/650/cmdline File opened for reading /proc/706/cmdline File opened for reading /proc/713/cmdline File opened for reading /proc/726/cmdline File opened for reading /proc/734/cmdline File opened for reading /proc/595/cmdline File opened for reading /proc/636/cmdline File opened for reading /proc/641/cmdline File opened for reading /proc/708/cmdline File opened for reading /proc/730/cmdline File opened for reading /proc/575/cmdline File opened for reading /proc/639/cmdline File opened for reading /proc/646/cmdline File opened for reading /proc/642/cmdline File opened for reading /proc/714/cmdline File opened for reading /proc/718/cmdline File opened for reading /proc/724/cmdline File opened for reading /proc/732/cmdline File opened for reading /proc/592/cmdline File opened for reading /proc/736/cmdline File opened for reading /proc/674/cmdline File opened for reading /proc/720/cmdline File opened for reading /proc/728/cmdline File opened for reading /proc/596/cmdline File opened for reading /proc/716/cmdline File opened for reading /proc/722/cmdline