Analysis
-
max time kernel
95s -
max time network
152s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240418-en -
resource tags
arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
05-07-2024 07:10
Static task
static1
Behavioral task
behavioral1
Sample
aa39f2c0aef4786e47c5b31fc6f6b3cf.elf
Resource
debian9-mipsel-20240418-en
General
-
Target
aa39f2c0aef4786e47c5b31fc6f6b3cf.elf
-
Size
150KB
-
MD5
aa39f2c0aef4786e47c5b31fc6f6b3cf
-
SHA1
f1fad7869c3669018c721bbea3aba6edddd3a493
-
SHA256
b1453cfc8475cb719bcaef4815d91c332aa3047351c364faaf7878005aacf75c
-
SHA512
3b7f35f71d12cc034e2c2ccb09021c3534688b9c61804d582bbbd1e673aa2cba68200efbf654f6f4cf40df6b3e3b827511b1a263b68c6385787ebd4827f71cf8
-
SSDEEP
1536:Q7kH/BIKaTvlIN0a5GUAPG5XojTPc4TzGbDrXwY55UYRgCcElTUSrs:Q6/BQTv1CGUAuXi7c4TIwm5rx
Malware Config
Signatures
-
Contacts a large (96594) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
aa39f2c0aef4786e47c5b31fc6f6b3cf.elfdescription ioc process File opened for modification /dev/watchdog aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for modification /dev/misc/watchdog aa39f2c0aef4786e47c5b31fc6f6b3cf.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 1 IoCs
Processes:
aa39f2c0aef4786e47c5b31fc6f6b3cf.elfdescription ioc process File opened for modification /sbin/watchdog aa39f2c0aef4786e47c5b31fc6f6b3cf.elf -
Changes its process name 1 IoCs
Processes:
aa39f2c0aef4786e47c5b31fc6f6b3cf.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself 692 aa39f2c0aef4786e47c5b31fc6f6b3cf.elf -
Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
aa39f2c0aef4786e47c5b31fc6f6b3cf.elfdescription ioc process File opened for reading /sys/devices/virtual/misc/watchdog aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /sys/class/misc/watchdog aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /sys/class/watchdog aa39f2c0aef4786e47c5b31fc6f6b3cf.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
aa39f2c0aef4786e47c5b31fc6f6b3cf.elfdescription ioc process File opened for reading /proc/727/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/756/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/773/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/779/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/711/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/711/exe aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/722/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/737/exe aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/748/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/709/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/740/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/753/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/685/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/770/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/706/exe aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/747/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/772/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/775/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/741/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/761/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/349/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/780/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/750/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/746/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/758/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/718/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/751/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/752/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/781/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/733/exe aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/782/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/776/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/707/exe aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/749/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/323/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/765/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/694/exe aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/786/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/766/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/734/exe aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/759/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/320/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/720/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/715/exe aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/706/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/757/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/694/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/710/stat aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/377/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/740/exe aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/734/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/736/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/742/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/713/exe aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/696/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/739/exe aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/378/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/392/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/768/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/653/exe aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/725/exe aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/739/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/785/cmdline aa39f2c0aef4786e47c5b31fc6f6b3cf.elf File opened for reading /proc/717/exe aa39f2c0aef4786e47c5b31fc6f6b3cf.elf