Analysis
-
max time kernel
150s -
max time network
152s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
10-10-2024 06:54
Static task
static1
Behavioral task
behavioral1
Sample
na.elf
Resource
debian12-armhf-20240418-en
debian-12-armhf
8 signatures
150 seconds
General
-
Target
na.elf
-
Size
123KB
-
MD5
ffa10038353177481db7ade52635ff24
-
SHA1
526d7ad8f5099aed534d33865be077c73195ae57
-
SHA256
10e60ddb3c9d4d49ea2f8d3367251b2fc6184c09045f2280eabbef445bd69c21
-
SHA512
bac76a82bfc56025b003f95165652e41ec4d089eaa575736d924de1d7f24b5e4123d5c681898e5b3c12c4014a1a1428d62067e08c96b1e14cbc9b882499c363e
-
SSDEEP
3072:WlfO5f2sciAFutKj+8jO7a6X5mdV+dXFzqwqu/s:kfOh2Ret2O7a6X5mdVSXTH/s
Score
9/10
Malware Config
Signatures
-
Contacts a large (193386) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
na.elfdescription ioc Process File opened for modification /dev/watchdog na.elf File opened for modification /dev/misc/watchdog na.elf -
Renames itself 1 IoCs
Processes:
na.elfpid Process 699 na.elf -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 185.84.81.194 Destination IP 54.36.111.116 Destination IP 54.36.111.116 Destination IP 63.231.92.27 Destination IP 63.231.92.27 -
Reads process memory 1 TTPs 13 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
Processes:
na.elfdescription ioc Process File opened for reading /proc/222/maps na.elf File opened for reading /proc/444/maps na.elf File opened for reading /proc/11/maps na.elf File opened for reading /proc/22/maps na.elf File opened for reading /proc/44/maps na.elf File opened for reading /proc/66/maps na.elf File opened for reading /proc/77/maps na.elf File opened for reading /proc/88/maps na.elf File opened for reading /proc/33/maps na.elf File opened for reading /proc/55/maps na.elf File opened for reading /proc/111/maps na.elf File opened for reading /proc/333/maps na.elf File opened for reading /proc/555/maps na.elf -
Changes its process name 1 IoCs
Processes:
na.elfdescription ioc pid Process Changes the process name, possibly in an attempt to hide itself uddev 699 na.elf -
Processes:
na.elfdescription ioc Process File opened for reading /proc/33335/maps na.elf File opened for reading /proc/222l�/maps na.elf File opened for reading /proc/222m�/maps na.elf File opened for reading /proc/222�/maps na.elf File opened for reading /proc/333s�/maps na.elf File opened for reading /proc/2222r2/maps na.elf File opened for reading /proc/2222�3/maps na.elf File opened for reading /proc/3333�4/maps na.elf File opened for reading /proc/3333#5/maps na.elf File opened for reading /proc/3333fffffff/maps na.elf File opened for reading /proc/99ssl/maps na.elf File opened for reading /proc/111c�/maps na.elf File opened for reading /proc/222v�/maps na.elf File opened for reading /proc/333�/maps na.elf File opened for reading /proc/444d�/maps na.elf File opened for reading /proc/777k�/maps na.elf File opened for reading /proc/1111�/maps na.elf File opened for reading /proc/111n/maps na.elf File opened for reading /proc/111x/maps na.elf File opened for reading /proc/3333u4/maps na.elf File opened for reading /proc/3333�4/maps na.elf File opened for reading /proc/6666/;/maps na.elf File opened for reading /proc/6666@;/maps na.elf File opened for reading /proc/555s�/maps na.elf File opened for reading /proc/1111i;/maps na.elf File opened for reading /proc/2222c4/maps na.elf File opened for reading /proc/3333�4/maps na.elf File opened for reading /proc/6666�8/maps na.elf File opened for reading /proc/6666�8/maps na.elf File opened for reading /proc/6666q;/maps na.elf File opened for reading /proc/333s�/maps na.elf File opened for reading /proc/1111b0/maps na.elf File opened for reading /proc/3333?5/maps na.elf File opened for reading /proc/6666 ;/maps na.elf File opened for reading /proc/6666p;/maps na.elf File opened for reading /proc/6666r;/maps na.elf File opened for reading /proc/6666t;/maps na.elf File opened for reading /proc/111c~/maps na.elf File opened for reading /proc/222�/maps na.elf File opened for reading /proc/222c�/maps na.elf File opened for reading /proc/3333N5/maps na.elf File opened for reading /proc/111uv/maps na.elf File opened for reading /proc/333�/maps na.elf File opened for reading /proc/1111j;/maps na.elf File opened for reading /proc/6666�7/maps na.elf File opened for reading /proc/66668/maps na.elf File opened for reading /proc/7777/maps na.elf File opened for reading /proc/3333o;/maps na.elf File opened for reading /proc/6666s;/maps na.elf File opened for reading /proc/6666u;/maps na.elf