Analysis
-
max time kernel
132s -
max time network
148s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
19-04-2024 13:44
Behavioral task
behavioral1
Sample
57387202c335220f7e19bbb08758a735d3307ae45e3fbe6ee1e1bffe9e3da53d.elf
Resource
debian9-armhf-20240226-en
General
-
Target
57387202c335220f7e19bbb08758a735d3307ae45e3fbe6ee1e1bffe9e3da53d.elf
-
Size
157KB
-
MD5
bc86183c67db69ea5c83b7a596a6cc21
-
SHA1
74fcd1752f465bc553b55cc66500529ce9039dd1
-
SHA256
57387202c335220f7e19bbb08758a735d3307ae45e3fbe6ee1e1bffe9e3da53d
-
SHA512
dfc2bf571029a7d21791ab35d17b3cbf30048a18350222df76241807a16e419c4d4d28bb8972d33e77440ac82851ecd02ba9461de69da086b525213f819b1feb
-
SSDEEP
3072:SHQhEOh1gTtA58ixaREUAdZJ3ujmR+1yeT2gBoM/94GPJ2P:SHQhaGhxaREUAdZRuD4eT2gSM/948J2
Malware Config
Signatures
-
Changes its process name 1 IoCs
Processes:
57387202c335220f7e19bbb08758a735d3307ae45e3fbe6ee1e1bffe9e3da53d.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself c6v3kvp850tolu48kbqougvlm1n3 656 57387202c335220f7e19bbb08758a735d3307ae45e3fbe6ee1e1bffe9e3da53d.elf -
Deletes itself 1 IoCs
Processes:
57387202c335220f7e19bbb08758a735d3307ae45e3fbe6ee1e1bffe9e3da53d.elfpid process 656 57387202c335220f7e19bbb08758a735d3307ae45e3fbe6ee1e1bffe9e3da53d.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
57387202c335220f7e19bbb08758a735d3307ae45e3fbe6ee1e1bffe9e3da53d.elfdescription ioc process File opened for modification /dev/watchdog 57387202c335220f7e19bbb08758a735d3307ae45e3fbe6ee1e1bffe9e3da53d.elf File opened for modification /dev/misc/watchdog 57387202c335220f7e19bbb08758a735d3307ae45e3fbe6ee1e1bffe9e3da53d.elf -
Reads runtime system information 62 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/222/cmdline File opened for reading /proc/6666�0/cmdline File opened for reading /proc/6666�4/cmdline File opened for reading /proc/444s�"/cmdline File opened for reading /proc/1111"-/cmdline File opened for reading /proc/1111�%/cmdline File opened for reading /proc/2222+/cmdline File opened for reading /proc/2222�,/cmdline File opened for reading /proc/3333/cmdline File opened for reading /proc/666644/cmdline File opened for reading /proc/6666�4/cmdline File opened for reading /proc/6666�4/cmdline File opened for reading /proc/6666�4/cmdline File opened for reading /proc/6666�4/cmdline File opened for reading /proc/66667/cmdline File opened for reading /proc/1111!-/cmdline File opened for reading /proc/1111#-/cmdline File opened for reading /proc/6666%1/cmdline File opened for reading /proc/999�"/cmdline File opened for reading /proc/2222�*/cmdline File opened for reading /proc/2222C+/cmdline File opened for reading /proc/5555�0/cmdline File opened for reading /proc/111m�"/cmdline File opened for reading /proc/222l�"/cmdline File opened for reading /proc/222s�"/cmdline File opened for reading /proc/1111�"/cmdline File opened for reading /proc/11/cmdline File opened for reading /proc/33/cmdline File opened for reading /proc/222�"/cmdline File opened for reading /proc/6666+1/cmdline File opened for reading /proc/6666�4/cmdline File opened for reading /proc/77/cmdline File opened for reading /proc/99/cmdline File opened for reading /proc/222v�"/cmdline File opened for reading /proc/6666�4/cmdline File opened for reading /proc/111�"/cmdline File opened for reading /proc/3333�,/cmdline File opened for reading /proc/66/cmdline File opened for reading /proc/111�"/cmdline File opened for reading /proc/1111�#/cmdline File opened for reading /proc/2222@*/cmdline File opened for reading /proc/3333�4/cmdline File opened for reading /proc/6666�4/cmdline File opened for reading /proc/222i�"/cmdline File opened for reading /proc/22/cmdline File opened for reading /proc/1111 -/cmdline File opened for reading /proc/111/cmdline File opened for reading /proc/111c�"/cmdline File opened for reading /proc/444/cmdline File opened for reading /proc/2222x+/cmdline File opened for reading /proc/6666�3/cmdline File opened for reading /proc/222�"/cmdline File opened for reading /proc/44/cmdline File opened for reading /proc/88ll�"/cmdline File opened for reading /proc/1111�"/cmdline File opened for reading /proc/55/cmdline File opened for reading /proc/111c�"/cmdline File opened for reading /proc/777s�"/cmdline File opened for reading /proc/1111$-/cmdline File opened for reading /proc/3333�,/cmdline File opened for reading /proc/6666�4/cmdline File opened for reading /proc/2222)/cmdline