General

  • Target

    na.elf

  • Size

    99KB

  • Sample

    241010-hpb2eswcpl

  • MD5

    38886db10a384a1e73ffabccb9238bf7

  • SHA1

    a49168056b5983e71284ae1763e4137e7e3833b6

  • SHA256

    b98deb6e17828b98b27d18577fb8420df7ec9529b88afa470915e9edb1cf731c

  • SHA512

    85d234be9e8105c8470b991b08c21c1fbf02a86ac2b61a9d75a1b19cf965440f5c9ca7bfb2207bf2da88de00715ab5baed2f408b3f66a67868c46c5e2e95755f

  • SSDEEP

    1536:pTKgOunFegPVcXmKtrJ5C+NKb3Ox2PUc6zhH:pNL7PKWKhJ5DNKb7P6zh

Malware Config

Targets

    • Target

      na.elf

    • Size

      99KB

    • MD5

      38886db10a384a1e73ffabccb9238bf7

    • SHA1

      a49168056b5983e71284ae1763e4137e7e3833b6

    • SHA256

      b98deb6e17828b98b27d18577fb8420df7ec9529b88afa470915e9edb1cf731c

    • SHA512

      85d234be9e8105c8470b991b08c21c1fbf02a86ac2b61a9d75a1b19cf965440f5c9ca7bfb2207bf2da88de00715ab5baed2f408b3f66a67868c46c5e2e95755f

    • SSDEEP

      1536:pTKgOunFegPVcXmKtrJ5C+NKb3Ox2PUc6zhH:pNL7PKWKhJ5DNKb7P6zh

    • Contacts a large (57466) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Deletes system logs

      Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Renames itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Deletes log files

      Deletes log files on the system.

    • Reads process memory

      Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

MITRE ATT&CK Enterprise v15

Tasks