Analysis
-
max time kernel
149s -
max time network
181s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
05-07-2024 01:19
Static task
static1
Behavioral task
behavioral1
Sample
4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf
Resource
debian9-armhf-20240611-en
General
-
Target
4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf
-
Size
40KB
-
MD5
c99458fc9a49677e024216579ef02a94
-
SHA1
26fff5fd74499baa447da3833251a6f5bc1a511d
-
SHA256
4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd
-
SHA512
9a3adf5ac12c239a208fee391830da093d377573127d499aa7488b070552242efc295b3ffbd35f3f3bd07906591eae51cb1dafc8ab00ffa7f375d29854da538c
-
SSDEEP
768:9iS+UJFoznkDHzYOkd1W06QNDU3A58ScQ8zD+G7nI8sR:h+UgkYOkzWKUU4PDJnI8sR
Malware Config
Signatures
-
Contacts a large (4699) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for modification /dev/misc/watchdog 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf -
Renames itself 1 IoCs
pid Process 644 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 178.254.22.166 Destination IP 168.235.111.72 Destination IP 185.232.68.212 Destination IP 139.84.165.176 Destination IP 139.84.165.176 -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 644 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/573/status 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/593/status 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/674/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/715/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/765/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/780/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/671/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/731/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/770/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/773/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/782/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/688/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/749/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/770/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/297/status 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/594/status 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/671/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/673/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/764/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/678/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/726/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/730/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/743/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/638/status 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/685/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/708/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/715/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/750/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/269/status 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/742/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/767/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/709/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/717/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/744/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/746/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/761/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/785/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/589/status 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/674/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/694/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/701/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/724/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/766/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/767/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/780/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/591/status 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/681/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/712/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/754/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/754/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/769/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/677/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/687/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/690/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/693/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/736/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/748/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/764/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/678/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/681/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/683/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/698/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/728/maps 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf File opened for reading /proc/728/cmdline 4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf
Processes
-
/tmp/4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf/tmp/4a8d0ddc053f2b876bef239524557be093a08154c035cf1c2d4cb1bc27693bbd.elf1⤵
- Modifies Watchdog functionality
- Renames itself
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:644