Analysis
-
max time kernel
148s -
max time network
148s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
-
submitted
06/03/2024, 03:20
General
-
Target
10e35fc807a25d970d073531883cb15b933e6799b730f7407189f2ac1e6eb5c3.elf
-
Size
122KB
-
MD5
bf73038b731c453e962980992ac72a45
-
SHA1
56c25f6d732276b5231a107587a78217e330309f
-
SHA256
10e35fc807a25d970d073531883cb15b933e6799b730f7407189f2ac1e6eb5c3
-
SHA512
e2ca8606ad30f90e4907a731d975d2020b062151cb458396bd80cabe074662cdef1b5a55271ac61d5b5ebe755e4b36d86649768bc317e4f239b484680cc8b71a
-
SSDEEP
3072:4jDy/+mh1vtbPIKalbpcUPium7/L7QsvmGfIiNb:mOJ1vxfalbywm7/L7QsvmGfIiNb
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/10e35fc807a25d970d073531883cb15b933e6799b730f7407189f2ac1e6eb5c3.elf/tmp/10e35fc807a25d970d073531883cb15b933e6799b730f7407189f2ac1e6eb5c3.elf1⤵
- Changes its process name
- Reads system routing table
- Reads system network configuration