Overview

overview

9

Static

static

8

ded36b111f...65.elf

debian-9-mips

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6b0fb88c187a6dbf48017f66f262edab.bin

  • Size

    131KB

  • Sample

    240727-cfgyessgpe

  • MD5

    78e936631a3729b7253af09af13077f4

  • SHA1

    f1d5ef43381dac561fedb1ab27f67412b8cb8275

  • SHA256

    9d370bc2eef356436e19325149a976ba171f047ad8501612d397642b9bbe36fa

  • SHA512

    c184dc486ee93679a435702787c4ab19242a73caba78677bfb0041b0809a59e4a741d8cd207eeb24d482e655f962756b06082ceab96d81b5f13581ff9e6cf983

  • SSDEEP

    3072:mhZFvLhoKayJI/swa4YDeiPUEp6jDv22+E79wUgGIoi:mhvLFayURCTg/+LEqRx9

Score
9/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      ded36b111f815e57e2658bd881beaf247be1fea999902456df83840100f5ae65.elf

    • Size

      134KB

    • MD5

      6b0fb88c187a6dbf48017f66f262edab

    • SHA1

      c27a02fbe6525becc24193041359a9adce663f24

    • SHA256

      ded36b111f815e57e2658bd881beaf247be1fea999902456df83840100f5ae65

    • SHA512

      1aae2f3a544e5145747b5f2dfc68957a11d9d14c9229c977dbb954e3f361974c9530ac152fd288e3cec973d9e6660a6f0d185b656647cd7a1e258b8bcf0448a1

    • SSDEEP

      3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioX:p3lOYoaja8xzx/0wsxzSi6

    Score
    9/10
    discoverypersistenceupx

    • Contacts a large (3895) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Patched UPX-packed file

      Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Writes file to system bin folder

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks