5dff36c4a9ad2d2a2a0ada5b3e437b072228cf84578dfcb6469449d4da044634

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20240226-en
resource tags

arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
11-03-2024 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

849eab00ff07333dd09e56dcb9b3f0d7.elf
Size

140KB
MD5

849eab00ff07333dd09e56dcb9b3f0d7
SHA1

1a7d18289da60dd8552b16fd06ea62e6f6de14c2
SHA256

5dff36c4a9ad2d2a2a0ada5b3e437b072228cf84578dfcb6469449d4da044634
SHA512

c637f8bceb7bfeb6adbdc95b4ce9c6bbb80c94377612041de9645f27b63446e3bd03cd57275def1678882ed8f6593a927476f7cb4252e01a4b9067ffbe0a016c
SSDEEP

3072:IbvYVCCuwCv38ZaY+lKRzziaCfjSoKGT33T7zYwMM/9CF:IbvYV5uwssZaRlKRzziZjxb3T7zRMM/i

Score

7^/10

discovery

Malware Config

Signatures

Changes its process name 1 IoCs

Processes:

849eab00ff07333dd09e56dcb9b3f0d7.elf

description ioc pid process

Changes the process name, possibly in an attempt to hide itself telnetd 642 849eab00ff07333dd09e56dcb9b3f0d7.elf
Deletes itself 1 IoCs

Processes:

849eab00ff07333dd09e56dcb9b3f0d7.elf

pid process

642 849eab00ff07333dd09e56dcb9b3f0d7.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	telnetd	642	849eab00ff07333dd09e56dcb9b3f0d7.elf

pid	process
642	849eab00ff07333dd09e56dcb9b3f0d7.elf

Unexpected DNS network traffic destination 7 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	38.103.195.4
Destination IP	38.103.195.4
Destination IP	64.176.6.48
Destination IP	64.176.6.48
Destination IP	64.176.6.48
Destination IP	64.176.6.48
Destination IP	64.176.6.48

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
File opened for reading	/proc/719/cmdline
File opened for reading	/proc/722/cmdline
File opened for reading	/proc/737/cmdline
File opened for reading	/proc/751/cmdline
File opened for reading	/proc/74/cmdline
File opened for reading	/proc/682/cmdline
File opened for reading	/proc/690/cmdline
File opened for reading	/proc/692/cmdline
File opened for reading	/proc/770/cmdline
File opened for reading	/proc/776/cmdline
File opened for reading	/proc/96/cmdline
File opened for reading	/proc/678/cmdline
File opened for reading	/proc/681/cmdline
File opened for reading	/proc/700/cmdline
File opened for reading	/proc/577/cmdline
File opened for reading	/proc/637/cmdline
File opened for reading	/proc/725/cmdline
File opened for reading	/proc/747/cmdline
File opened for reading	/proc/670/cmdline
File opened for reading	/proc/10/cmdline
File opened for reading	/proc/595/cmdline
File opened for reading	/proc/769/cmdline
File opened for reading	/proc/780/cmdline
File opened for reading	/proc/264/cmdline
File opened for reading	/proc/275/cmdline
File opened for reading	/proc/655/cmdline
File opened for reading	/proc/774/cmdline
File opened for reading	/proc/16/cmdline
File opened for reading	/proc/24/cmdline
File opened for reading	/proc/273/cmdline
File opened for reading	/proc/647/cmdline
File opened for reading	/proc/761/cmdline
File opened for reading	/proc/762/cmdline
File opened for reading	/proc/763/cmdline
File opened for reading	/proc/1/cmdline
File opened for reading	/proc/26/cmdline
File opened for reading	/proc/301/cmdline
File opened for reading	/proc/679/cmdline
File opened for reading	/proc/104/cmdline
File opened for reading	/proc/107/cmdline
File opened for reading	/proc/702/cmdline
File opened for reading	/proc/4/cmdline
File opened for reading	/proc/138/cmdline
File opened for reading	/proc/143/cmdline
File opened for reading	/proc/676/cmdline
File opened for reading	/proc/14/cmdline
File opened for reading	/proc/641/cmdline
File opened for reading	/proc/768/cmdline
File opened for reading	/proc/23/cmdline
File opened for reading	/proc/597/cmdline
File opened for reading	/proc/713/cmdline
File opened for reading	/proc/764/cmdline
File opened for reading	/proc/19/cmdline
File opened for reading	/proc/707/cmdline
File opened for reading	/proc/726/cmdline
File opened for reading	/proc/758/cmdline
File opened for reading	/proc/721/cmdline
File opened for reading	/proc/733/cmdline
File opened for reading	/proc/741/cmdline
File opened for reading	/proc/15/cmdline
File opened for reading	/proc/18/cmdline
File opened for reading	/proc/25/cmdline
File opened for reading	/proc/694/cmdline
File opened for reading	/proc/696/cmdline

/tmp/849eab00ff07333dd09e56dcb9b3f0d7.elf
/tmp/849eab00ff07333dd09e56dcb9b3f0d7.elf
1⤵
- Changes its process name
- Deletes itself
PID:642

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads