c4ca35db2a19f880b40867e814250a55d27b1621c39160ffc436e6653c06f976

Analysis

max time kernel
146s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
03-09-2024 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4ca35db2a19f880b40867e814250a55d27b1621c39160ffc436e6653c06f976.elf
Size

118KB
MD5

3022d8d617de493e53d40cf02ff12aac
SHA1

024784163955d70de27ade20b60a648dd4be9264
SHA256

c4ca35db2a19f880b40867e814250a55d27b1621c39160ffc436e6653c06f976
SHA512

73f4a9ffc0b28cc1c4aedfec3d4c9b09d6171a848b32c6eabedf60f953ff6acedb6d9dcf3517ec5d5864755eeaaa6d7729b2559ea776b025c2b317d9db0db51c
SSDEEP

1536:zxPRAmySO4TJNXIav45fSvJyRIDuGnMa9toHbDrOjP8El:zx8SfTJNXIw4VSvJ/Mwom

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
707	c4ca35db2a19f880b40867e814250a55d27b1621c39160ffc436e6653c06f976.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	c4ca35db2a19f880b40867e814250a55d27b1621c39160ffc436e6653c06f976.elf
File opened for modification	/dev/watchdog	c4ca35db2a19f880b40867e814250a55d27b1621c39160ffc436e6653c06f976.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	c4ca35db2a19f880b40867e814250a55d27b1621c39160ffc436e6653c06f976.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/tcp	c4ca35db2a19f880b40867e814250a55d27b1621c39160ffc436e6653c06f976.elf

/tmp/c4ca35db2a19f880b40867e814250a55d27b1621c39160ffc436e6653c06f976.elf
/tmp/c4ca35db2a19f880b40867e814250a55d27b1621c39160ffc436e6653c06f976.elf
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
PID:707

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads