Analysis
-
max time kernel
150s -
max time network
155s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
12-10-2024 15:09
Behavioral task
behavioral1
Sample
na.elf
Resource
debian12-mipsel-20240221-en
General
-
Target
na.elf
-
Size
90KB
-
MD5
803d17dbfe0962640f6ab115f2594514
-
SHA1
09ad3f6560a5da29b0f9c7e83b18cac921ba24ed
-
SHA256
3f1c562a2126a513e253a200ae8ed9024d21c1b1eae4155c3dcd04d4e2aa33eb
-
SHA512
b14b4ca41e1b15d7ec85431ff658219003d6951fbe7394932fcbd2647000d07f2c383b256d82d6f3a7800fa427f5fa49fc8945435a2a6b3242159339e54138bc
-
SSDEEP
1536:a5DnSB+v5MjQm2g17xk49d6xZLu8vJ4TGo8S:a5TSB+v5MjQm11GFrvhrS
Malware Config
Signatures
-
Contacts a large (86510) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
na.elfdescription ioc process File opened for modification /dev/watchdog na.elf File opened for modification /dev/misc/watchdog na.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
na.elfdescription ioc process File opened for reading /proc/net/tcp na.elf -
Reads process memory 1 TTPs 16 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
Processes:
na.elfdescription ioc process File opened for reading /proc/667/maps na.elf File opened for reading /proc/679/maps na.elf File opened for reading /proc/680/maps na.elf File opened for reading /proc/716/maps na.elf File opened for reading /proc/717/maps na.elf File opened for reading /proc/695/maps na.elf File opened for reading /proc/710/maps na.elf File opened for reading /proc/743/maps na.elf File opened for reading /proc/752/maps na.elf File opened for reading /proc/697/maps na.elf File opened for reading /proc/720/maps na.elf File opened for reading /proc/733/maps na.elf File opened for reading /proc/746/maps na.elf File opened for reading /proc/413/maps na.elf File opened for reading /proc/732/maps na.elf File opened for reading /proc/745/maps na.elf -
Changes its process name 1 IoCs
Processes:
na.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself d65ac5s8qmu78foc 742 na.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
na.elfdescription ioc process File opened for reading /proc/net/tcp na.elf