ea22a852eaf0b7dd3e7b0a1c7d7fcff4fe66bb6875f611aefee2a5f0b45a273d

Analysis

max time kernel
6s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
28-06-2024 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33a8f48fbd45a071419a7213affd014d.elf
Size

106KB
MD5

33a8f48fbd45a071419a7213affd014d
SHA1

ab024426e73c70f8e5eb0903080e81444bcef54b
SHA256

ea22a852eaf0b7dd3e7b0a1c7d7fcff4fe66bb6875f611aefee2a5f0b45a273d
SHA512

75bd9de735baa8daa0e0ff3cc4ab942134bd3948097e8385bf410ad345643b370f02ef3e8ddf6002745e64524cbbcccd170a4fdf10036ee253e962fd6ef571dc
SSDEEP

3072:2bB8eJ2RC0w4NQJYrFzguMAt8nrMjrkvB9wrVMtvAT00LKrcTw0nINLzsrI5:2bB8w2fNW9cTw0nINLzsr

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

33a8f48fbd45a071419a7213affd014d.elf

pid process

696 33a8f48fbd45a071419a7213affd014d.elf

pid	process
696	33a8f48fbd45a071419a7213affd014d.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

33a8f48fbd45a071419a7213affd014d.elf

description	ioc	process
File opened for modification	/dev/misc/watchdog	33a8f48fbd45a071419a7213affd014d.elf
File opened for modification	/dev/watchdog	33a8f48fbd45a071419a7213affd014d.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

33a8f48fbd45a071419a7213affd014d.elf

description ioc process

File opened for reading /proc/net/tcp 33a8f48fbd45a071419a7213affd014d.elf
Changes its process name 1 IoCs

Processes:

33a8f48fbd45a071419a7213affd014d.elf

description ioc pid process

Changes the process name, possibly in an attempt to hide itself j3d86ie8attkfj8o 696 33a8f48fbd45a071419a7213affd014d.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

33a8f48fbd45a071419a7213affd014d.elf

description ioc process

File opened for reading /proc/net/tcp 33a8f48fbd45a071419a7213affd014d.elf

description	ioc	process
File opened for reading	/proc/net/tcp	33a8f48fbd45a071419a7213affd014d.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	j3d86ie8attkfj8o	696	33a8f48fbd45a071419a7213affd014d.elf

description	ioc	process
File opened for reading	/proc/net/tcp	33a8f48fbd45a071419a7213affd014d.elf

/tmp/33a8f48fbd45a071419a7213affd014d.elf
/tmp/33a8f48fbd45a071419a7213affd014d.elf
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
PID:696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads