Analysis
-
max time kernel
149s -
max time network
153s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
10-10-2024 06:53
Static task
static1
Behavioral task
behavioral1
Sample
na.elf
Resource
debian12-armhf-20240418-en
debian-12-armhf
7 signatures
150 seconds
General
-
Target
na.elf
-
Size
61KB
-
MD5
d155adcf6e6e692f242351fb6b71e7fb
-
SHA1
f0b5333c7c76d2837c5389e9854c3432f11ae589
-
SHA256
d4a6b428adbbee7ef528dd595fe44bd448e07c67bf201aaa771f5343104c3621
-
SHA512
d8a6e657e2d8177193818eae54c18d1d710876b85caadcd3f54585db150549b13482b1bc283499aa2767615479202ab91a2661bff5cb0d5e5aabcc2e5abbdee2
-
SSDEEP
1536:nEng1PtXEtN8zHZJ3ELUdcQ4E12N5nDoEigvFUm1R:3FtXEtwJRd1xEvFUm1R
Score
9/10
Malware Config
Signatures
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
na.elfdescription ioc Process File opened for modification /dev/watchdog na.elf File opened for modification /dev/misc/watchdog na.elf -
Renames itself 1 IoCs
Processes:
na.elfpid Process 703 na.elf -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 147.78.121.189 Destination IP 108.165.48.201 Destination IP 147.78.121.189 Destination IP 108.165.48.201 Destination IP 147.78.121.189 Destination IP 192.3.165.37 -
Reads process memory 1 TTPs 13 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
Processes:
na.elfdescription ioc Process File opened for reading /proc/44/maps na.elf File opened for reading /proc/55/maps na.elf File opened for reading /proc/66/maps na.elf File opened for reading /proc/77/maps na.elf File opened for reading /proc/333/maps na.elf File opened for reading /proc/444/maps na.elf File opened for reading /proc/11/maps na.elf File opened for reading /proc/33/maps na.elf File opened for reading /proc/88/maps na.elf File opened for reading /proc/111/maps na.elf File opened for reading /proc/222/maps na.elf File opened for reading /proc/555/maps na.elf File opened for reading /proc/22/maps na.elf -
Changes its process name 1 IoCs
Processes:
na.elfdescription ioc pid Process Changes the process name, possibly in an attempt to hide itself uddev 703 na.elf -
Processes:
na.elfdescription ioc Process File opened for reading /proc/66668/maps na.elf File opened for reading /proc/6666;/maps na.elf File opened for reading /proc/6666�;/maps na.elf File opened for reading /proc/222�/maps na.elf File opened for reading /proc/333s�/maps na.elf File opened for reading /proc/3333p4/maps na.elf File opened for reading /proc/3333�4/maps na.elf File opened for reading /proc/3333;/maps na.elf File opened for reading /proc/222v�/maps na.elf File opened for reading /proc/3333r5/maps na.elf File opened for reading /proc/7777�;/maps na.elf File opened for reading /proc/2222�3/maps na.elf File opened for reading /proc/2222e4/maps na.elf File opened for reading /proc/6666�:/maps na.elf File opened for reading /proc/222�/maps na.elf File opened for reading /proc/222m�/maps na.elf File opened for reading /proc/333�/maps na.elf File opened for reading /proc/444d�/maps na.elf File opened for reading /proc/777k�/maps na.elf File opened for reading /proc/7777};/maps na.elf File opened for reading /proc/7777/maps na.elf File opened for reading /proc/7777�;/maps na.elf File opened for reading /proc/111u|/maps na.elf File opened for reading /proc/1111n;/maps na.elf File opened for reading /proc/3333fffffff/maps na.elf File opened for reading /proc/6666�7/maps na.elf File opened for reading /proc/6666�;/maps na.elf File opened for reading /proc/3333`5/maps na.elf File opened for reading /proc/6666�8/maps na.elf File opened for reading /proc/99ssr/maps na.elf File opened for reading /proc/111c�/maps na.elf File opened for reading /proc/222l�/maps na.elf File opened for reading /proc/3333�4/maps na.elf File opened for reading /proc/6666D;/maps na.elf File opened for reading /proc/7777l;/maps na.elf File opened for reading /proc/222c�/maps na.elf File opened for reading /proc/333�/maps na.elf File opened for reading /proc/555s�/maps na.elf File opened for reading /proc/1111b0/maps na.elf File opened for reading /proc/3333A5/maps na.elf File opened for reading /proc/1111o;/maps na.elf File opened for reading /proc/1111�2/maps na.elf File opened for reading /proc/3333�4/maps na.elf File opened for reading /proc/111t/maps na.elf File opened for reading /proc/111~/maps na.elf File opened for reading /proc/111c�/maps na.elf File opened for reading /proc/333s�/maps na.elf File opened for reading /proc/1111�/maps na.elf File opened for reading /proc/333385/maps na.elf File opened for reading /proc/6666�8/maps na.elf File opened for reading /proc/6666%;/maps na.elf