d72e0090674786faa67a43c46fd535bfbb08a0ade84ccc542ec96478d7845403

Analysis

max time kernel
143s
max time network
167s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
28-06-2024 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a597a99ccc6078fe27f63d34d4535f2.elf
Size

64KB
MD5

2a597a99ccc6078fe27f63d34d4535f2
SHA1

666934dc3f33bee267b2c1ed28792c063c76b28c
SHA256

d72e0090674786faa67a43c46fd535bfbb08a0ade84ccc542ec96478d7845403
SHA512

17d4f786f7ffe5005735995775722d169a497f68d529f23ccf64a8515b53806cb3f479dd2e8d0938b3a58430885863b8186f53f20976d94b116e985dc803abd6
SSDEEP

1536:f3nA8EZjpQOO60NjqSMT11xKbSZYuE53qBGYI6ZEOit/zIi:YB5tX0bSZbEF+87

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

2a597a99ccc6078fe27f63d34d4535f2.elf

pid process

706 2a597a99ccc6078fe27f63d34d4535f2.elf

pid	process
706	2a597a99ccc6078fe27f63d34d4535f2.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

2a597a99ccc6078fe27f63d34d4535f2.elf

description	ioc	process
File opened for modification	/dev/watchdog	2a597a99ccc6078fe27f63d34d4535f2.elf
File opened for modification	/dev/misc/watchdog	2a597a99ccc6078fe27f63d34d4535f2.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

2a597a99ccc6078fe27f63d34d4535f2.elf

description ioc process

File opened for reading /proc/net/tcp 2a597a99ccc6078fe27f63d34d4535f2.elf
Changes its process name 1 IoCs

Processes:

2a597a99ccc6078fe27f63d34d4535f2.elf

description ioc pid process

Changes the process name, possibly in an attempt to hide itself 81u5eqs1s04iamtp 706 2a597a99ccc6078fe27f63d34d4535f2.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

2a597a99ccc6078fe27f63d34d4535f2.elf

description ioc process

File opened for reading /proc/net/tcp 2a597a99ccc6078fe27f63d34d4535f2.elf

description	ioc	process
File opened for reading	/proc/net/tcp	2a597a99ccc6078fe27f63d34d4535f2.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	81u5eqs1s04iamtp	706	2a597a99ccc6078fe27f63d34d4535f2.elf

description	ioc	process
File opened for reading	/proc/net/tcp	2a597a99ccc6078fe27f63d34d4535f2.elf

/tmp/2a597a99ccc6078fe27f63d34d4535f2.elf
/tmp/2a597a99ccc6078fe27f63d34d4535f2.elf
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
PID:706

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads