be9fab09564f6c0f959cd6c011a355a6f579ab70b8e1602ec3edfb0a62bab412

Analysis

max time kernel
146s
max time network
149s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
12/10/2024, 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be9fab09564f6c0f959cd6c011a355a6f579ab70b8e1602ec3edfb0a62bab412.elf
Size

50KB
MD5

4a04b3a39ab5bcbda7c03bee73de5eb9
SHA1

fcedc84ad494abc321dc55487086c9801066ec79
SHA256

be9fab09564f6c0f959cd6c011a355a6f579ab70b8e1602ec3edfb0a62bab412
SHA512

ff50943e0f78b1208c0b8a3d1ef447334d3714670699d6506242083ac0c229b0283906327d5c275f3ebb31210db64e539b8a4f6f85582dd51e963c1baaba3924
SSDEEP

1536:1hTPm7HmYTUOtEuC1IRip7Q3puC8jzV4KT6KAW6Sxv:1hTO7HjdtrC1IRiBiTKygVAWJ

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	be9fab09564f6c0f959cd6c011a355a6f579ab70b8e1602ec3edfb0a62bab412.elf
File opened for modification	/dev/misc/watchdog	be9fab09564f6c0f959cd6c011a355a6f579ab70b8e1602ec3edfb0a62bab412.elf

Writes file to system bin folder 1 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	be9fab09564f6c0f959cd6c011a355a6f579ab70b8e1602ec3edfb0a62bab412.elf

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1559	be9fab09564f6c0f959cd6c011a355a6f579ab70b8e1602ec3edfb0a62bab412.elf

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/virtual/misc/watchdog	be9fab09564f6c0f959cd6c011a355a6f579ab70b8e1602ec3edfb0a62bab412.elf
File opened for reading	/sys/class/misc/watchdog	be9fab09564f6c0f959cd6c011a355a6f579ab70b8e1602ec3edfb0a62bab412.elf
File opened for reading	/sys/class/watchdog	be9fab09564f6c0f959cd6c011a355a6f579ab70b8e1602ec3edfb0a62bab412.elf

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/mounts	be9fab09564f6c0f959cd6c011a355a6f579ab70b8e1602ec3edfb0a62bab412.elf

/tmp/be9fab09564f6c0f959cd6c011a355a6f579ab70b8e1602ec3edfb0a62bab412.elf
/tmp/be9fab09564f6c0f959cd6c011a355a6f579ab70b8e1602ec3edfb0a62bab412.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1559

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...