648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b

General

Target

648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf
Size

74KB
MD5

20d263bd6e0552cad17ec45eeff1844b
SHA1

67a23901d5f3276ba4e8c95c21aeb79ca584a36a
SHA256

648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b
SHA512

f721ddcbcb19d22057d8a4b7402fa8d852872b3df3de18a13b8c983407fb29cd06ef7b9c35c4c50a179ac98fd2e70296806487fc59d4a9e291fa248662ac5eef
SSDEEP

1536:EUPldq0TJFnqXKvdo7DYZXjs56tbWuhyN/XemIdRI1R+5vY1SLq7wTVVi:9NdDznqoK7D4s5UWxem0I1R+JeSOcTf

Score

7^/10

evasion

Malware Config

Signatures

Changes its process name 1 IoCs

Processes:

648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	t10vfkgrpbjqdmd7	1574	648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf

Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
evasion

Indicator Removal
T1070

Processes:

description ioc

File deleted /var/log/audit/audit.log
Deletes itself 1 IoCs

Processes:

648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf

pid process

1574 648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf
Deletes journal logs 1 TTPs 1 IoCs
Deletes systemd journal logs. Likely to evade detection.
evasion

Indicator Removal
T1070

Processes:

description ioc

File deleted /var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
evasion

Indicator Removal
T1070

Processes:

description ioc

File deleted /var/log/syslog

description	ioc
File deleted	/var/log/audit/audit.log

pid	process
1574	648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf

description	ioc
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal

description	ioc
File deleted	/var/log/syslog

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf

description	ioc	process
File opened for modification	/dev/misc/watchdog	648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf
File opened for modification	/dev/watchdog	648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 10 IoCs

System Information Discovery

T1082

Processes:

pkillpkillpkillpkillpkillpkillpkillpkillpkillpkill

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pkillpkillpkillpkillpkillpkillpkillpkillpkillpkill

description	ioc	process
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/31/cmdline	pkill
File opened for reading	/proc/1137/cmdline	pkill
File opened for reading	/proc/1363/status	pkill
File opened for reading	/proc/1570/cmdline	pkill
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/172/status	pkill
File opened for reading	/proc/1167/status	pkill
File opened for reading	/proc/1196/cmdline	pkill
File opened for reading	/proc/180/cmdline
File opened for reading	/proc/32/cmdline	pkill
File opened for reading	/proc/171/status	pkill
File opened for reading	/proc/429/cmdline	pkill
File opened for reading	/proc/520/status	pkill
File opened for reading	/proc/1129/cmdline	pkill
File opened for reading	/proc/80/status	pkill
File opened for reading	/proc/166/status	pkill
File opened for reading	/proc/1121/cmdline	pkill
File opened for reading	/proc/1360/cmdline	pkill
File opened for reading	/proc/1576/cmdline	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/454/cmdline	pkill
File opened for reading	/proc/1155/cmdline	pkill
File opened for reading	/proc/1363/status	pkill
File opened for reading	/proc/1584/cmdline	pkill
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/27/status	pkill
File opened for reading	/proc/171/cmdline	pkill
File opened for reading	/proc/492/status	pkill
File opened for reading	/proc/1181/status	pkill
File opened for reading	/proc/1189/status	pkill
File opened for reading	/proc/1577/status	pkill
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/601/cmdline	pkill
File opened for reading	/proc/1196/cmdline	pkill
File opened for reading	/proc/1570/cmdline	pkill
File opened for reading	/proc/1647/cmdline
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/470/status	pkill
File opened for reading	/proc/1193/cmdline	pkill
File opened for reading	/proc/1296/status	pkill
File opened for reading	/proc/1579/status	pkill
File opened for reading	/proc/169/cmdline	pkill
File opened for reading	/proc/438/status	pkill
File opened for reading	/proc/1053/status	pkill
File opened for reading	/proc/1121/status	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/454/cmdline	pkill
File opened for reading	/proc/718/cmdline	pkill
File opened for reading	/proc/1200/status	pkill
File opened for reading	/proc/1579/cmdline	pkill
File opened for reading	/proc/30/status	pkill
File opened for reading	/proc/1576/cmdline	pkill
File opened for reading	/proc/164/cmdline	pkill
File opened for reading	/proc/522/status	pkill
File opened for reading	/proc/971/cmdline	pkill
File opened for reading	/proc/1098/status	pkill
File opened for reading	/proc/1461/cmdline	pkill
File opened for reading	/proc/79/status	pkill
File opened for reading	/proc/1076/status	pkill
File opened for reading	/proc/1155/cmdline	pkill

/tmp/648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf
/tmp/648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf
1⤵
- Changes its process name
- Deletes itself
- Modifies Watchdog functionality
PID:1574

/usr/local/sbin/pkill
pkill wireshark
1⤵
PID:1578

/usr/local/bin/pkill
pkill wireshark
1⤵
PID:1578

/usr/sbin/pkill
pkill wireshark
1⤵
PID:1578

/usr/bin/pkill
pkill wireshark
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1578

/usr/local/sbin/pkill
pkill dumpcap
1⤵
PID:1579

/usr/local/bin/pkill
pkill dumpcap
1⤵
PID:1579

/usr/sbin/pkill
pkill dumpcap
1⤵
PID:1579

/usr/bin/pkill
pkill dumpcap
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1579

/usr/local/sbin/pkill
pkill tshark
1⤵
PID:1577

/usr/local/bin/pkill
pkill tshark
1⤵
PID:1577

/usr/sbin/pkill
pkill tshark
1⤵
PID:1577

/usr/bin/pkill
pkill tshark
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1577

/usr/local/sbin/pkill
pkill ettercap
1⤵
PID:1580

/usr/local/bin/pkill
pkill ettercap
1⤵
PID:1580

/usr/sbin/pkill
pkill ettercap
1⤵
PID:1580

/usr/bin/pkill
pkill ettercap
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1580

/usr/local/sbin/pkill
pkill dsniff
1⤵
PID:1581

/usr/local/bin/pkill
pkill dsniff
1⤵
PID:1581

/usr/sbin/pkill
pkill dsniff
1⤵
PID:1581

/usr/bin/pkill
pkill dsniff
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1581

/usr/local/sbin/pkill
pkill ngrep
1⤵
PID:1582

/usr/local/bin/pkill
pkill ngrep
1⤵
PID:1582

/usr/sbin/pkill
pkill ngrep
1⤵
PID:1582

/usr/bin/pkill
pkill ngrep
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1582

/usr/local/sbin/pkill
pkill netsniff-ng
1⤵
PID:1585

/usr/local/sbin/pkill
pkill tcpdump
1⤵
PID:1576

/usr/local/sbin/pkill
pkill windump
1⤵
PID:1584

/usr/local/bin/pkill
pkill netsniff-ng
1⤵
PID:1585

/usr/sbin/pkill
pkill netsniff-ng
1⤵
PID:1585

/usr/local/bin/pkill
pkill tcpdump
1⤵
PID:1576

/usr/local/bin/pkill
pkill windump
1⤵
PID:1584

/usr/local/sbin/pkill
pkill tcpflow
1⤵
PID:1583

/usr/bin/pkill
pkill netsniff-ng
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1585

/usr/sbin/pkill
pkill tcpdump
1⤵
PID:1576

/usr/sbin/pkill
pkill windump
1⤵
PID:1584

/usr/local/bin/pkill
pkill tcpflow
1⤵
PID:1583

/usr/bin/pkill
pkill tcpdump
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1576

/usr/bin/pkill
pkill windump
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1584

/usr/sbin/pkill
pkill tcpflow
1⤵
PID:1583

/usr/bin/pkill
pkill tcpflow
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1583

/usr/local/sbin/rm
rm -rf /usr/sbin/ngrep
1⤵
PID:1595

/usr/local/bin/rm
rm -rf /usr/sbin/ngrep
1⤵
PID:1595

/usr/sbin/rm
rm -rf /usr/sbin/ngrep
1⤵
PID:1595

/usr/bin/rm
rm -rf /usr/sbin/ngrep
1⤵
PID:1595

/sbin/rm
rm -rf /usr/sbin/ngrep
1⤵
PID:1595

/bin/rm
rm -rf /usr/sbin/ngrep
1⤵
PID:1595

/usr/local/sbin/rm
rm -rf /usr/sbin/tcpflow
1⤵
PID:1596

/usr/local/bin/rm
rm -rf /usr/sbin/tcpflow
1⤵
PID:1596

/usr/sbin/rm
rm -rf /usr/sbin/tcpflow
1⤵
PID:1596

/usr/bin/rm
rm -rf /usr/sbin/tcpflow
1⤵
PID:1596

/sbin/rm
rm -rf /usr/sbin/tcpflow
1⤵
PID:1596

/bin/rm
rm -rf /usr/sbin/tcpflow
1⤵
PID:1596

/usr/local/sbin/rm
rm -rf /usr/bin/tshark
1⤵
PID:1600

/usr/local/bin/rm
rm -rf /usr/bin/tshark
1⤵
PID:1600

/usr/sbin/rm
rm -rf /usr/bin/tshark
1⤵
PID:1600

/usr/bin/rm
rm -rf /usr/bin/tshark
1⤵
PID:1600

/sbin/rm
rm -rf /usr/bin/tshark
1⤵
PID:1600

/bin/rm
rm -rf /usr/bin/tshark
1⤵
PID:1600

/usr/local/sbin/rm
rm -rf /usr/bin/ettercap
1⤵
PID:1603

/usr/local/bin/rm
rm -rf /usr/bin/ettercap
1⤵
PID:1603

/usr/sbin/rm
rm -rf /usr/bin/ettercap
1⤵
PID:1603

/usr/bin/rm
rm -rf /usr/bin/ettercap
1⤵
PID:1603

/sbin/rm
rm -rf /usr/bin/ettercap
1⤵
PID:1603

/usr/local/sbin/rm
rm -rf /usr/bin/dsniff
1⤵
PID:1604

/usr/local/bin/rm
rm -rf /usr/bin/dsniff
1⤵
PID:1604

/usr/sbin/rm
rm -rf /usr/bin/dsniff
1⤵
PID:1604

/usr/bin/rm
rm -rf /usr/bin/dsniff
1⤵
PID:1604

/sbin/rm
rm -rf /usr/bin/dsniff
1⤵
PID:1604

/bin/rm
rm -rf /usr/bin/dsniff
1⤵
PID:1604

/usr/local/sbin/rm
rm -rf /usr/bin/ngrep
1⤵
PID:1605

/usr/local/bin/rm
rm -rf /usr/bin/ngrep
1⤵
PID:1605

/usr/sbin/rm
rm -rf /usr/bin/ngrep
1⤵
PID:1605

/usr/bin/rm
rm -rf /usr/bin/ngrep
1⤵
PID:1605

/sbin/rm
rm -rf /usr/bin/ngrep
1⤵
PID:1605

/bin/rm
rm -rf /usr/bin/ngrep
1⤵
PID:1605

/usr/local/sbin/rm
rm -rf /usr/bin/tcpflow
1⤵
PID:1606

/usr/local/bin/rm
rm -rf /usr/bin/tcpflow
1⤵
PID:1606

/usr/sbin/rm
rm -rf /usr/bin/tcpflow
1⤵
PID:1606

/usr/bin/rm
rm -rf /usr/bin/tcpflow
1⤵
PID:1606

/sbin/rm
rm -rf /usr/bin/tcpflow
1⤵
PID:1606

/bin/rm
rm -rf /usr/bin/tcpflow
1⤵
PID:1606

/usr/local/sbin/rm
rm -rf /usr/bin/netsniff-ng
1⤵
PID:1608

/usr/local/bin/rm
rm -rf /usr/bin/netsniff-ng
1⤵
PID:1608

/usr/sbin/rm
rm -rf /usr/bin/netsniff-ng
1⤵
PID:1608

/usr/bin/rm
rm -rf /usr/bin/netsniff-ng
1⤵
PID:1608

/sbin/rm
rm -rf /usr/bin/netsniff-ng
1⤵
PID:1608

/bin/rm
rm -rf /usr/bin/netsniff-ng
1⤵
PID:1608

/usr/local/sbin/rm
rm -rf /usr/sbin/windump
1⤵
PID:1597

/usr/local/bin/rm
rm -rf /usr/sbin/windump
1⤵
PID:1597

/usr/sbin/rm
rm -rf /usr/sbin/windump
1⤵
PID:1597

/usr/bin/rm
rm -rf /usr/sbin/windump
1⤵
PID:1597

/sbin/rm
rm -rf /usr/sbin/windump
1⤵
PID:1597

/bin/rm
rm -rf /usr/sbin/windump
1⤵
PID:1597

/usr/local/sbin/rm
rm -rf /usr/sbin/netsniff-ng
1⤵
PID:1598

/usr/local/bin/rm
rm -rf /usr/sbin/netsniff-ng
1⤵
PID:1598

/usr/sbin/rm
rm -rf /usr/sbin/netsniff-ng
1⤵
PID:1598

/usr/bin/rm
rm -rf /usr/sbin/netsniff-ng
1⤵
PID:1598

/sbin/rm
rm -rf /usr/sbin/netsniff-ng
1⤵
PID:1598

/bin/rm
rm -rf /usr/sbin/netsniff-ng
1⤵
PID:1598

/usr/local/sbin/rm
rm -rf /usr/bin/tcpdump
1⤵
PID:1599

/usr/local/bin/rm
rm -rf /usr/bin/tcpdump
1⤵
PID:1599

/usr/sbin/rm
rm -rf /usr/bin/tcpdump
1⤵
PID:1599

/usr/bin/rm
rm -rf /usr/bin/tcpdump
1⤵
PID:1599

/sbin/rm
rm -rf /usr/bin/tcpdump
1⤵
PID:1599

/bin/rm
rm -rf /usr/bin/tcpdump
1⤵
PID:1599

/usr/local/sbin/rm
rm -rf /usr/bin/wireshark
1⤵
PID:1601

/usr/local/bin/rm
rm -rf /usr/bin/wireshark
1⤵
PID:1601

/usr/sbin/rm
rm -rf /usr/bin/wireshark
1⤵
PID:1601

/usr/bin/rm
rm -rf /usr/bin/wireshark
1⤵
PID:1601

/sbin/rm
rm -rf /usr/bin/wireshark
1⤵
PID:1601

/bin/rm
rm -rf /usr/bin/wireshark
1⤵
PID:1601

/usr/local/sbin/rm
rm -rf /usr/bin/dumpcap
1⤵
PID:1602

/usr/local/bin/rm
rm -rf /usr/bin/dumpcap
1⤵
PID:1602

/usr/sbin/rm
rm -rf /usr/bin/dumpcap
1⤵
PID:1602

/usr/bin/rm
rm -rf /usr/bin/dumpcap
1⤵
PID:1602

/sbin/rm
rm -rf /usr/bin/dumpcap
1⤵
PID:1602

/bin/rm
rm -rf /usr/bin/dumpcap
1⤵
PID:1602

/usr/local/sbin/rm
rm -rf /usr/bin/windump
1⤵
PID:1607

/usr/local/bin/rm
rm -rf /usr/bin/windump
1⤵
PID:1607

/usr/sbin/rm
rm -rf /usr/bin/windump
1⤵
PID:1607

/usr/bin/rm
rm -rf /usr/bin/windump
1⤵
PID:1607

/sbin/rm
rm -rf /usr/bin/windump
1⤵
PID:1607

/bin/rm
rm -rf /usr/bin/windump
1⤵
PID:1607

/usr/local/sbin/rm
rm -rf /usr/sbin/dsniff
1⤵
PID:1594

/usr/local/bin/rm
rm -rf /usr/sbin/dsniff
1⤵
PID:1594

/usr/sbin/rm
rm -rf /usr/sbin/dsniff
1⤵
PID:1594

/usr/bin/rm
rm -rf /usr/sbin/dsniff
1⤵
PID:1594

/sbin/rm
rm -rf /usr/sbin/dsniff
1⤵
PID:1594

/bin/rm
rm -rf /usr/sbin/dsniff
1⤵
PID:1594

/usr/local/sbin/rm
rm -rf /usr/sbin/ettercap
1⤵
PID:1593

/usr/local/bin/rm
rm -rf /usr/sbin/ettercap
1⤵
PID:1593

/usr/sbin/rm
rm -rf /usr/sbin/ettercap
1⤵
PID:1593

/usr/bin/rm
rm -rf /usr/sbin/ettercap
1⤵
PID:1593

/sbin/rm
rm -rf /usr/sbin/ettercap
1⤵
PID:1593

/bin/rm
rm -rf /usr/sbin/ettercap
1⤵
PID:1593

/bin/rm
rm -rf /usr/bin/ettercap
1⤵
PID:1603

/usr/local/sbin/rm
rm -rf /usr/sbin/dumpcap
1⤵
PID:1592

/usr/local/bin/rm
rm -rf /usr/sbin/dumpcap
1⤵
PID:1592

/usr/sbin/rm
rm -rf /usr/sbin/dumpcap
1⤵
PID:1592

/usr/bin/rm
rm -rf /usr/sbin/dumpcap
1⤵
PID:1592

/sbin/rm
rm -rf /usr/sbin/dumpcap
1⤵
PID:1592

/bin/rm
rm -rf /usr/sbin/dumpcap
1⤵
PID:1592

/usr/local/sbin/rm
rm -rf /usr/sbin/wireshark
1⤵
PID:1591

/usr/local/bin/rm
rm -rf /usr/sbin/wireshark
1⤵
PID:1591

/usr/sbin/rm
rm -rf /usr/sbin/wireshark
1⤵
PID:1591

/usr/bin/rm
rm -rf /usr/sbin/wireshark
1⤵
PID:1591

/sbin/rm
rm -rf /usr/sbin/wireshark
1⤵
PID:1591

/bin/rm
rm -rf /usr/sbin/wireshark
1⤵
PID:1591

/usr/local/sbin/rm
rm -rf /usr/sbin/tshark
1⤵
PID:1590

/usr/local/bin/rm
rm -rf /usr/sbin/tshark
1⤵
PID:1590

/usr/sbin/rm
rm -rf /usr/sbin/tshark
1⤵
PID:1590

/usr/bin/rm
rm -rf /usr/sbin/tshark
1⤵
PID:1590

/sbin/rm
rm -rf /usr/sbin/tshark
1⤵
PID:1590

/bin/rm
rm -rf /usr/sbin/tshark
1⤵
PID:1590

/usr/local/sbin/rm
rm -rf /usr/sbin/tcpdump
1⤵
PID:1589

/usr/local/bin/rm
rm -rf /usr/sbin/tcpdump
1⤵
PID:1589

/usr/sbin/rm
rm -rf /usr/sbin/tcpdump
1⤵
PID:1589

/usr/bin/rm
rm -rf /usr/sbin/tcpdump
1⤵
PID:1589

/sbin/rm
rm -rf /usr/sbin/tcpdump
1⤵
PID:1589

/bin/rm
rm -rf /usr/sbin/tcpdump
1⤵
PID:1589

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

3

T1070

Impair Defenses

1

T1562

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads