Overview

overview

7

Static

static

7

9902d9e621...8e.elf

debian-9-armhf

7

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240226-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    25-03-2024 12:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9902d9e62143c1d0a654891a9442eb8e.elf

  • Size

    58KB

  • MD5

    9902d9e62143c1d0a654891a9442eb8e

  • SHA1

    93f1b2728a33790d08a9d2c0e6081dee9fc7790b

  • SHA256

    53cd55d36870f40208918b630d07d6aaf8031950a7368a51f2749b52e3de3d3d

  • SHA512

    94e5f2aac374d2ecb0b8d4574d15986f7f8f57b2877ae81eda67607d7d18aad13161f1951437b55d8714d59d287fe56296f9ce446051a155df2b2bf6ddca1f85

  • SSDEEP

    1536:RU66RZWV5dH2RNX38m/1mSBaneNKu5Zpy86TRWx:n6LeWLXMSQKaneNKu9ydTRWx

Score
7/10

Malware Config

Signatures

  • Changes its process name 1 IoCs
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/9902d9e62143c1d0a654891a9442eb8e.elf
    /tmp/9902d9e62143c1d0a654891a9442eb8e.elf
    1⤵
    • Changes its process name
    • Reads runtime system information
    PID:637
  • /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    1⤵
      PID:643
      • /sbin/iptables
        iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
        2⤵
          PID:645
      • /bin/sh
        sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
        1⤵
          PID:655
          • /bin/busybox
            /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
            2⤵
              PID:657
          • /bin/sh
            sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
            1⤵
              PID:658
              • /bin/iptables
                /bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
                2⤵
                  PID:660
              • /bin/sh
                sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
                1⤵
                  PID:662
                  • /usr/bin/iptables
                    /usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
                    2⤵
                      PID:664
                  • /bin/sh
                    sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
                    1⤵
                      PID:665
                      • /bin/busybox
                        busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
                        2⤵
                          PID:667

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads