Analysis
-
max time kernel
132s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
-
submitted
22-04-2024 01:39
General
-
Target
80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969.elf
-
Size
74KB
-
MD5
8374373a2be97dcc625de716147ff1fe
-
SHA1
629895abb50371a12550a0720c4c410119dd1d23
-
SHA256
80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969
-
SHA512
cb4093b62495432dbd9fec90644556d3dc28dbf455cfc5787dd4d2880cd5221ae7f7a1913642e215fb6be9b4779a262b37f59dac8ba28b05bf9eca0f3e19d9e8
-
SSDEEP
1536:/AZlz2ROCO6/fvqz/HYmGNZcYKb7k2v2H8pdqE1Cp:/AZIzQAcYKb7k2LpXCp
Score
7/10
Malware Config
Signatures
-
Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
-
Deletes itself 1 IoCs
-
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Deletes log files 1 TTPs 1 IoCs
Deletes log files on the system.
-
Changes its process name 1 IoCs
Processes
-
/tmp/80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969.elf/tmp/80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969.elf1⤵
- Deletes Audit logs
- Deletes itself
- Deletes system logs
- Modifies Watchdog functionality
- Deletes log files
- Changes its process name