Analysis
-
max time kernel
149s -
max time network
153s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
10-10-2024 06:53
Static task
static1
Behavioral task
behavioral1
Sample
na.elf
Resource
debian12-armhf-20240418-en
debian-12-armhf
7 signatures
150 seconds
General
-
Target
na.elf
-
Size
61KB
-
MD5
d155adcf6e6e692f242351fb6b71e7fb
-
SHA1
f0b5333c7c76d2837c5389e9854c3432f11ae589
-
SHA256
d4a6b428adbbee7ef528dd595fe44bd448e07c67bf201aaa771f5343104c3621
-
SHA512
d8a6e657e2d8177193818eae54c18d1d710876b85caadcd3f54585db150549b13482b1bc283499aa2767615479202ab91a2661bff5cb0d5e5aabcc2e5abbdee2
-
SSDEEP
1536:nEng1PtXEtN8zHZJ3ELUdcQ4E12N5nDoEigvFUm1R:3FtXEtwJRd1xEvFUm1R
Score
9/10
Malware Config
Signatures
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog na.elf File opened for modification /dev/misc/watchdog na.elf -
Renames itself 1 IoCs
pid Process 703 na.elf -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 147.78.121.189 Destination IP 108.165.48.201 Destination IP 147.78.121.189 Destination IP 108.165.48.201 Destination IP 147.78.121.189 Destination IP 192.3.165.37 -
Reads process memory 1 TTPs 13 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/44/maps na.elf File opened for reading /proc/55/maps na.elf File opened for reading /proc/66/maps na.elf File opened for reading /proc/77/maps na.elf File opened for reading /proc/333/maps na.elf File opened for reading /proc/444/maps na.elf File opened for reading /proc/11/maps na.elf File opened for reading /proc/33/maps na.elf File opened for reading /proc/88/maps na.elf File opened for reading /proc/111/maps na.elf File opened for reading /proc/222/maps na.elf File opened for reading /proc/555/maps na.elf File opened for reading /proc/22/maps na.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself uddev 703 na.elf -
description ioc Process File opened for reading /proc/66668/maps na.elf File opened for reading /proc/6666;/maps na.elf File opened for reading /proc/6666�;/maps na.elf File opened for reading /proc/222�/maps na.elf File opened for reading /proc/333s�/maps na.elf File opened for reading /proc/3333p4/maps na.elf File opened for reading /proc/3333�4/maps na.elf File opened for reading /proc/3333;/maps na.elf File opened for reading /proc/222v�/maps na.elf File opened for reading /proc/3333r5/maps na.elf File opened for reading /proc/7777�;/maps na.elf File opened for reading /proc/2222�3/maps na.elf File opened for reading /proc/2222e4/maps na.elf File opened for reading /proc/6666�:/maps na.elf File opened for reading /proc/222�/maps na.elf File opened for reading /proc/222m�/maps na.elf File opened for reading /proc/333�/maps na.elf File opened for reading /proc/444d�/maps na.elf File opened for reading /proc/777k�/maps na.elf File opened for reading /proc/7777};/maps na.elf File opened for reading /proc/7777/maps na.elf File opened for reading /proc/7777�;/maps na.elf File opened for reading /proc/111u|/maps na.elf File opened for reading /proc/1111n;/maps na.elf File opened for reading /proc/3333fffffff/maps na.elf File opened for reading /proc/6666�7/maps na.elf File opened for reading /proc/6666�;/maps na.elf File opened for reading /proc/3333`5/maps na.elf File opened for reading /proc/6666�8/maps na.elf File opened for reading /proc/99ssr/maps na.elf File opened for reading /proc/111c�/maps na.elf File opened for reading /proc/222l�/maps na.elf File opened for reading /proc/3333�4/maps na.elf File opened for reading /proc/6666D;/maps na.elf File opened for reading /proc/7777l;/maps na.elf File opened for reading /proc/222c�/maps na.elf File opened for reading /proc/333�/maps na.elf File opened for reading /proc/555s�/maps na.elf File opened for reading /proc/1111b0/maps na.elf File opened for reading /proc/3333A5/maps na.elf File opened for reading /proc/1111o;/maps na.elf File opened for reading /proc/1111�2/maps na.elf File opened for reading /proc/3333�4/maps na.elf File opened for reading /proc/111t/maps na.elf File opened for reading /proc/111~/maps na.elf File opened for reading /proc/111c�/maps na.elf File opened for reading /proc/333s�/maps na.elf File opened for reading /proc/1111�/maps na.elf File opened for reading /proc/333385/maps na.elf File opened for reading /proc/6666�8/maps na.elf File opened for reading /proc/6666%;/maps na.elf