1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8

General

Target

1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
Size

170KB
MD5

4efe945f9e1798078778681cec73bc02
SHA1

9b08661e524a6d6e6b7077945f13ac3880700aa1
SHA256

1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8
SHA512

abe8df80d93cc3a11cda83c50d8cf9fb771ea177a3aea59a26559ab6688add7b369dba38932a2ab257ad0a3d01289ceff67232f03d0cf7f1fb5036aa6c11f1fa
SSDEEP

3072:e/eGibq3BRNvmovPKSgch4BqBoJMxhBSr23p+W8jDhmSpmRpByBqm+x:e/eGibq3BRFjvPXh2hJMxhBSgH8jA+mR

Score

7^/10

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf

description	ioc	process
File opened for modification	/dev/watchdog	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for modification	/dev/misc/watchdog	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf

Enumerates running processes
Discovers information about currently running processes on the system
Writes file to system bin folder 1 TTPs 1 IoCs

Hijack Execution Flow
T1574

Processes:

1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf

description ioc process

File opened for modification /bin/watchdog 1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf

description	ioc	process
File opened for modification	/bin/watchdog	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf

description	ioc	process
File opened for reading	/proc/164/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/86/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/475/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1347/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/24/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/166/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/79/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/85/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/84/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/574/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1004/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1096/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/403/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1095/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/21/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/72/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/998/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1080/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1446/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/631/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/19/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/537/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1089/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/404/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/162/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/637/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/160/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/177/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1425/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/974/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1088/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1360/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1438/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/23/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1078/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1386/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/131/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/74/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/77/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/865/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1418/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/168/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1246/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/564/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/89/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/856/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1346/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/171/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/456/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1362/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/693/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1069/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1439/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/265/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/564/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/102/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/201/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1110/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1178/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/6/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/6/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1095/cmdline	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1413/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
File opened for reading	/proc/1416/maps	1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf

/tmp/1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
/tmp/1c970c16ed8c614f23761583e1135233b315a4153b52d8c1cffed9aa0abddab8.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1417