Analysis
-
max time kernel
150s -
max time network
153s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
10-10-2024 06:53
Static task
static1
Behavioral task
behavioral1
Sample
na.elf
Resource
debian12-armhf-20240418-en
debian-12-armhf
7 signatures
150 seconds
General
-
Target
na.elf
-
Size
73KB
-
MD5
e51f86619c47dab7600c87664e23b0ed
-
SHA1
825901e5287199ca971697a30ddb13fa621f95c8
-
SHA256
5a53c58c88d848f504c13281e62e66d7fed2f7e75a68b0b9f82879c949406795
-
SHA512
219605cf7a441036b5c8b9e4cc9f757855ee6e26a515c53373775fceb7edba2d87c1698a71b905434104410c0f0341073b03e8e1d4a4e2aeed424756e1dcc34e
-
SSDEEP
1536:Uknswd9ILtxLmuP7E06hnkehh4R99W/NVnF2lPhiSM7Rkn:gE9ILtsaOmehhu99W/NOBM7A
Score
9/10
Malware Config
Signatures
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog na.elf File opened for modification /dev/misc/watchdog na.elf -
Renames itself 1 IoCs
pid Process 702 na.elf -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 147.78.121.189 Destination IP 147.78.121.189 -
Reads process memory 1 TTPs 13 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/22/maps na.elf File opened for reading /proc/33/maps na.elf File opened for reading /proc/77/maps na.elf File opened for reading /proc/88/maps na.elf File opened for reading /proc/111/maps na.elf File opened for reading /proc/222/maps na.elf File opened for reading /proc/444/maps na.elf File opened for reading /proc/555/maps na.elf File opened for reading /proc/11/maps na.elf File opened for reading /proc/44/maps na.elf File opened for reading /proc/55/maps na.elf File opened for reading /proc/66/maps na.elf File opened for reading /proc/333/maps na.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself uddev 702 na.elf -
description ioc Process File opened for reading /proc/111cv/maps na.elf File opened for reading /proc/333�/maps na.elf File opened for reading /proc/555s�/maps na.elf File opened for reading /proc/3333�4/maps na.elf File opened for reading /proc/6666M;/maps na.elf File opened for reading /proc/7777N;/maps na.elf File opened for reading /proc/111un/maps na.elf File opened for reading /proc/333�/maps na.elf File opened for reading /proc/1111;;/maps na.elf File opened for reading /proc/3333G5/maps na.elf File opened for reading /proc/3333d5/maps na.elf File opened for reading /proc/6666L;/maps na.elf File opened for reading /proc/111f/maps na.elf File opened for reading /proc/111p/maps na.elf File opened for reading /proc/777k�/maps na.elf File opened for reading /proc/1111:;/maps na.elf File opened for reading /proc/7777@;/maps na.elf File opened for reading /proc/6666 ;/maps na.elf File opened for reading /proc/222c�/maps na.elf File opened for reading /proc/333s�/maps na.elf File opened for reading /proc/2222�3/maps na.elf File opened for reading /proc/3333d4/maps na.elf File opened for reading /proc/6666�:/maps na.elf File opened for reading /proc/6666�:/maps na.elf File opened for reading /proc/99ssd/maps na.elf File opened for reading /proc/222m�/maps na.elf File opened for reading /proc/444d�/maps na.elf File opened for reading /proc/6666�7/maps na.elf File opened for reading /proc/6666�8/maps na.elf File opened for reading /proc/3333K;/maps na.elf File opened for reading /proc/7777/maps na.elf File opened for reading /proc/111cx/maps na.elf File opened for reading /proc/1111t1/maps na.elf File opened for reading /proc/1111�2/maps na.elf File opened for reading /proc/3333fffffff/maps na.elf File opened for reading /proc/3333w4/maps na.elf File opened for reading /proc/333395/maps na.elf File opened for reading /proc/6666�7/maps na.elf File opened for reading /proc/7777O;/maps na.elf File opened for reading /proc/222z/maps na.elf File opened for reading /proc/222l�/maps na.elf File opened for reading /proc/222�/maps na.elf File opened for reading /proc/333s�/maps na.elf File opened for reading /proc/2222Y4/maps na.elf File opened for reading /proc/3333t5/maps na.elf File opened for reading /proc/222v�/maps na.elf File opened for reading /proc/1111�/maps na.elf File opened for reading /proc/3333�4/maps na.elf File opened for reading /proc/6666�8/maps na.elf File opened for reading /proc/7777P;/maps na.elf