023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02

General

Target

023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
Size

153KB
MD5

88e66d3ffdb78ac36dec93f81f898ad1
SHA1

70383254c1f54b1401ba28ca982cc08b8a8f8cc5
SHA256

023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02
SHA512

0a00edfdac538586177dedb64df0fb28421b05220ae9a050c158ccdae929fab537637aa6011909793b428c34cb8fdbd630ef2471b563b5c584a621fe14e52b3e
SSDEEP

3072:HNaEkEJoa9niU5yae9xfKqF6bBtUKKRsSY6rOYLYM/9iAn9Q:HNa09iWyae9xfKq2BifdY6rOY8M/9Z9Q

Score

9^/10

discovery evasion

Malware Config

Signatures

Contacts a large (112103) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
evasion

Indicator Removal
T1070

Processes:

023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf

description ioc process

File deleted /var/log/audit/audit.log 023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf

description	ioc	process
File deleted	/var/log/audit/audit.log	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf

Deletes journal logs 1 TTPs 1 IoCs

Deletes systemd journal logs. Likely to evade detection.

evasion

Indicator Removal

T1070

Processes:

023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf

description	ioc	process
File deleted	/var/log/journal/65779e181e584f059cb9deb1099989c3/system.journal	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf

description	ioc	process
File opened for modification	/dev/watchdog	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for modification	/dev/misc/watchdog	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

Processes:

023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	/var/Cyber	701	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf

description	ioc	process
File opened for reading	/proc/143/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/14/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/16/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/25/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/32/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/13/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/45/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/703/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/710/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/11/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/18/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/57/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/1/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/2/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/3/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/6/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/682/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/24/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/33/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/311/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/647/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/339/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/360/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/706/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/4/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/9/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/26/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/31/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/221/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/256/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/313/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/629/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/8/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/19/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/46/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/193/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/708/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/663/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/5/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/15/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/17/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/51/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/7/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/707/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/34/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/42/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/343/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/680/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/21/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/36/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/56/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/187/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/73/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/677/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/699/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/709/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/20/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/28/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/35/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/196/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/29/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/325/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/322/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
File opened for reading	/proc/347/cmdline	023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf

/tmp/023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
/tmp/023a49b27d0b741a27487cc730e2289da4170336dc2c106db22e8fa3864d3c02.elf
1⤵
- Deletes Audit logs
- Deletes journal logs
- Modifies Watchdog functionality
- Changes its process name
- Reads runtime system information
PID:701

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Indicator Removal

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads