Overview

overview

9

Static

static

1

na.elf

debian-12-armhf

9

Analysis

  • max time kernel
    149s
  • max time network
    188s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20240221-en
  • resource tags

    arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    10-10-2024 06:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    na.elf

  • Size

    83KB

  • MD5

    14c2a689c249bf03878ba92ab2f9b2ed

  • SHA1

    26e1b2b29db94ef37cd4ac840ae8cb9ba684f8be

  • SHA256

    16f31d4bfc4b89c56e086bc4d70bfdc3564893f67dd8e6d5da7746781a27142d

  • SHA512

    2ee52a707dbb043690fa4ca194c6d428046c6f7c51eb682c70248e0fb80ba881e2d3262d84ae789d519771edbceb2840814380343d95ef5b3bdfdacf1126fc3c

  • SSDEEP

    1536:q8nWaX2yH6MatpoTkE8I/OXhWE1vsAn7lKQmA5Qk6elg2idGviO322nh:Yg2+6lt4BAl1bn7lKQmA5elGviOG2n

Score
9/10
credential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalatio

Malware Config

Signatures

  • Contacts a large (32428) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Renames itself 1 IoCs
  • Unexpected DNS network traffic destination 7 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio
  • Reads process memory 1 TTPs 13 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Changes its process name 1 IoCs
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

    Execute scripts via Unix Shell.

    execution
  • Reads runtime system information 52 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/na.elf
    /tmp/na.elf
    1⤵
    • Modifies Watchdog functionality
    • Renames itself
    • Reads process memory
    • Changes its process name
    • Reads runtime system information
    PID:709
    • /bin/sh
      /bin/sh -c "echo '*/5 * * * * //.ffdfd crontab' | crontab -"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:753
      • /usr/bin/crontab
        crontab -
        3⤵
        • Creates/modifies Cron job
        PID:755

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /var/spool/cron/crontabs/tmp.RdMNfy
    Filesize

    204B

    MD5

    21779fa02dbf485a571d0d00541490fb

    SHA1

    b0776409fa0f719275e8f84832ca3e7894e486bd

    SHA256

    fe7928846d68e821603c402c1e77b0a9b2cf71e620505e43d09e51f400042398

    SHA512

    cf897222504bc9a98a0b920b3e9743caecc32f457b631d4aeffe87740248312cb073e9fc8d45b32af96d8ebed7760a6c3af7ee5bc33c5a19a95b37d916a4e8a5

    Download Submit