Analysis
-
max time kernel
150s -
max time network
155s -
platform
debian-12_armhf -
resource
debian12-armhf-20240729-en -
resource tags
arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
10-10-2024 06:53
Static task
static1
Behavioral task
behavioral1
Sample
na.elf
Resource
debian12-armhf-20240729-en
debian-12-armhf
7 signatures
150 seconds
General
-
Target
na.elf
-
Size
71KB
-
MD5
74a94193d8cebb3ef9b686f0f49e1ba0
-
SHA1
b9674eab9d10f508d5e833aeda70699119778a6a
-
SHA256
06cd6e78c2097b258f9ef4f4efad5a3e9ea88a46eb2b61469f0e3e3f190acfd6
-
SHA512
fba8290132f446fd9a564619b9fa279c5afde06af3dd51ef58e0a80d192e004866f3d3a98afb44377e9a3629c169604241c40a5e0345b59653ba81ef1b2c25d3
-
SSDEEP
1536:8TnuQaeJrBtm6h7YEAGzg5HFF3qfCAgYXf+l0BiyUegc2rZ:9CJrBtV7bctFF3qfCAgabUegZ
Score
9/10
Malware Config
Signatures
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
na.elfdescription ioc Process File opened for modification /dev/watchdog na.elf File opened for modification /dev/misc/watchdog na.elf -
Renames itself 1 IoCs
Processes:
na.elfpid Process 706 na.elf -
Unexpected DNS network traffic destination 8 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 147.78.121.189 Destination IP 192.3.165.37 Destination IP 108.165.48.201 Destination IP 147.78.121.189 Destination IP 108.165.48.201 Destination IP 108.165.48.201 Destination IP 147.78.121.189 Destination IP 108.165.48.201 -
Reads process memory 1 TTPs 13 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
Processes:
na.elfdescription ioc Process File opened for reading /proc/333/maps na.elf File opened for reading /proc/22/maps na.elf File opened for reading /proc/33/maps na.elf File opened for reading /proc/55/maps na.elf File opened for reading /proc/66/maps na.elf File opened for reading /proc/88/maps na.elf File opened for reading /proc/111/maps na.elf File opened for reading /proc/222/maps na.elf File opened for reading /proc/11/maps na.elf File opened for reading /proc/44/maps na.elf File opened for reading /proc/77/maps na.elf File opened for reading /proc/444/maps na.elf File opened for reading /proc/555/maps na.elf -
Changes its process name 1 IoCs
Processes:
na.elfdescription ioc pid Process Changes the process name, possibly in an attempt to hide itself proftpd 706 na.elf -
Processes:
na.elfdescription ioc Process File opened for reading /proc/222�/maps na.elf File opened for reading /proc/1111�;/maps na.elf File opened for reading /proc/3333�4/maps na.elf File opened for reading /proc/7777�;/maps na.elf File opened for reading /proc/2222�;/maps na.elf File opened for reading /proc/3333:5/maps na.elf File opened for reading /proc/2222!4/maps na.elf File opened for reading /proc/6666 ;/maps na.elf File opened for reading /proc/333�/maps na.elf File opened for reading /proc/7777�;/maps na.elf File opened for reading /proc/99sse/maps na.elf File opened for reading /proc/6666�8/maps na.elf File opened for reading /proc/6666�;/maps na.elf File opened for reading /proc/222v�/maps na.elf File opened for reading /proc/2222fffffff/maps na.elf File opened for reading /proc/7777�;/maps na.elf File opened for reading /proc/3333�4/maps na.elf File opened for reading /proc/3333�;/maps na.elf File opened for reading /proc/6666�;/maps na.elf File opened for reading /proc/333s�/maps na.elf File opened for reading /proc/2222�3/maps na.elf File opened for reading /proc/6666(;/maps na.elf File opened for reading /proc/111g/maps na.elf File opened for reading /proc/222l�/maps na.elf File opened for reading /proc/555s�/maps na.elf File opened for reading /proc/1111x1/maps na.elf File opened for reading /proc/3333m5/maps na.elf File opened for reading /proc/7777�;/maps na.elf File opened for reading /proc/111cw/maps na.elf File opened for reading /proc/444d�/maps na.elf File opened for reading /proc/3333�4/maps na.elf File opened for reading /proc/6666�;/maps na.elf File opened for reading /proc/3333�4/maps na.elf File opened for reading /proc/3333E5/maps na.elf File opened for reading /proc/111uo/maps na.elf File opened for reading /proc/1111�;/maps na.elf File opened for reading /proc/1111V2/maps na.elf File opened for reading /proc/222m�/maps na.elf File opened for reading /proc/6666�7/maps na.elf File opened for reading /proc/7777};/maps na.elf File opened for reading /proc/222c�/maps na.elf File opened for reading /proc/777k�/maps na.elf File opened for reading /proc/7777/maps na.elf File opened for reading /proc/111cy/maps na.elf File opened for reading /proc/222{/maps na.elf File opened for reading /proc/6666�8/maps na.elf File opened for reading /proc/6666;/maps na.elf File opened for reading /proc/333s�/maps na.elf File opened for reading /proc/1111�/maps na.elf File opened for reading /proc/3333 5/maps na.elf File opened for reading /proc/6666;/maps na.elf File opened for reading /proc/111q/maps na.elf File opened for reading /proc/333�/maps na.elf File opened for reading /proc/66668/maps na.elf File opened for reading /proc/6666�:/maps na.elf