12ed34665a00c1146af0946b4d5507b7be233f304c5f4c112ae0f25cf5bce4f0

Resubmissions

22-05-2024 18:59

240522-xnd7qach31 10

22-05-2024 18:32

240522-w6z2gacb95 10

22-05-2024 14:30

240522-rt7hkaed46 10

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
22-05-2024 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12ed34665a00c1146af0946b4d5507b7be233f304c5f4c112ae0f25cf5bce4f0
Size

42KB
MD5

92c82e2f0de3f209ead988349a9fe116
SHA1

6707a7a20f202575552292bf2d176ef6f82b4403
SHA256

12ed34665a00c1146af0946b4d5507b7be233f304c5f4c112ae0f25cf5bce4f0
SHA512

d05cf486b73e5e95ba403763b74ba497e788a36863d4cfdacf108b50211fb2840ff48011423a4af9b4f7e8e59adbc31bfed908a672279abd98f2171dc6501ad1
SSDEEP

768:D/tQ282Ouq7CUORXVWCF8BciZ2xV8z4nRN5b:ztQ282Ouq7CUOZMCuy1xez4RN5b

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

12ed34665a00c1146af0946b4d5507b7be233f304c5f4c112ae0f25cf5bce4f0

pid process

1401 12ed34665a00c1146af0946b4d5507b7be233f304c5f4c112ae0f25cf5bce4f0

pid	process
1401	12ed34665a00c1146af0946b4d5507b7be233f304c5f4c112ae0f25cf5bce4f0

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

12ed34665a00c1146af0946b4d5507b7be233f304c5f4c112ae0f25cf5bce4f0

description	ioc	process
File opened for modification	/dev/watchdog	12ed34665a00c1146af0946b4d5507b7be233f304c5f4c112ae0f25cf5bce4f0
File opened for modification	/dev/misc/watchdog	12ed34665a00c1146af0946b4d5507b7be233f304c5f4c112ae0f25cf5bce4f0

Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 91.199.87.89
Destination IP 94.247.43.254

description	ioc
Destination IP	91.199.87.89
Destination IP	94.247.43.254

Changes its process name 1 IoCs

Processes:

12ed34665a00c1146af0946b4d5507b7be233f304c5f4c112ae0f25cf5bce4f0

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	/usr/PBoC	1401	12ed34665a00c1146af0946b4d5507b7be233f304c5f4c112ae0f25cf5bce4f0

/tmp/12ed34665a00c1146af0946b4d5507b7be233f304c5f4c112ae0f25cf5bce4f0
/tmp/12ed34665a00c1146af0946b4d5507b7be233f304c5f4c112ae0f25cf5bce4f0
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Changes its process name
PID:1401

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads