1697a8f026a43139d4fdcfe6d38146354d96b2fa7c969fda970adebf2be581a6

Analysis

max time kernel
96s
max time network
152s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
01-07-2024 21:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jew.mips.elf
Size

83KB
MD5

d5d4d70a0f3ada7d855813869a1d4c20
SHA1

205327d68a8aa1fe871edd8b414f743df9c6de0a
SHA256

1697a8f026a43139d4fdcfe6d38146354d96b2fa7c969fda970adebf2be581a6
SHA512

dcfe6433db50f08f3df147d3c748ed7cb2fd17548d79eb9d9209d9eb2926c853cebcb5a46766a10746ea16aa5bb27001bac2f182c9c6ecac04057e502dbe1f7e
SSDEEP

1536:NUQAWCADOvthOX0YBncWjcWBDnnv4BdPeX7Ss8vNkQJEltRSOzE6dV0q2dLSvP5k:NUQAWCADOlh20YBncWjcWB7nQBw7SsY5

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (55141) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Processes:

jew.mips.elf

description ioc process

File opened for modification /dev/misc/watchdog jew.mips.elf
File opened for modification /dev/watchdog jew.mips.elf
Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow
T1574

Processes:

jew.mips.elf

description ioc process

File opened for modification /bin/watchdog jew.mips.elf
File opened for modification /sbin/watchdog jew.mips.elf
Changes its process name 1 IoCs

Processes:

jew.mips.elf

description ioc pid process

Changes the process name, possibly in an attempt to hide itself dfEwmkloCafwCCma0/ 705 jew.mips.elf

description	ioc	process
File opened for modification	/dev/misc/watchdog	jew.mips.elf
File opened for modification	/dev/watchdog	jew.mips.elf

description	ioc	process
File opened for modification	/bin/watchdog	jew.mips.elf
File opened for modification	/sbin/watchdog	jew.mips.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	dfEwmkloCafwCCma0/	705	jew.mips.elf

/tmp/jew.mips.elf
/tmp/jew.mips.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
PID:705

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Impair Defenses

T1562

Hijack Execution Flow

T1574

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads