Analysis
-
max time kernel
136s -
max time network
148s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
14/10/2024, 05:22
Behavioral task
behavioral1
Sample
na.elf
Resource
debian9-mipsbe-20240729-en
5 signatures
150 seconds
General
-
Target
na.elf
-
Size
43KB
-
MD5
05fc26780b9a27ea77e3ec0871d07423
-
SHA1
053bc16a0169b941d3da6cad0fcaed6adc444dc2
-
SHA256
24ecc191f11be7b8ed2929acfbd71eabf107cafe915325bd4500eea55a2620f0
-
SHA512
9872a8ba6b26f6def2c2d2fef48574d3ea89c872dc1a678010ee09b7994a896b2909805648ea6ee853e1e268403c043859cd358bd6efef3ed6efece7d6cb7c8a
-
SSDEEP
768:M9DfzzMwdu3W4CbuznqQd8eYkGyJfH6QhjS0jlDGnHMhgNSRxUkCkHhVeg527tvU:qDEwdu3ubuznqreGyJfH6QhjDGnHMhgY
Score
10/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog na.elf File opened for modification /dev/misc/watchdog na.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog na.elf File opened for modification /bin/watchdog na.elf -
description ioc Process File opened for reading /proc/17/status na.elf File opened for reading /proc/20/status na.elf File opened for reading /proc/72/status na.elf File opened for reading /proc/341/status na.elf File opened for reading /proc/376/status na.elf File opened for reading /proc/716/status na.elf File opened for reading /proc/14/status na.elf File opened for reading /proc/36/status na.elf File opened for reading /proc/690/status na.elf File opened for reading /proc/715/status na.elf File opened for reading /proc/721/status na.elf File opened for reading /proc/723/status na.elf File opened for reading /proc/7/status na.elf File opened for reading /proc/71/status na.elf File opened for reading /proc/73/status na.elf File opened for reading /proc/81/status na.elf File opened for reading /proc/443/status na.elf File opened for reading /proc/689/status na.elf File opened for reading /proc/11/status na.elf File opened for reading /proc/16/status na.elf File opened for reading /proc/344/status na.elf File opened for reading /proc/2/status na.elf File opened for reading /proc/19/status na.elf File opened for reading /proc/24/status na.elf File opened for reading /proc/74/status na.elf File opened for reading /proc/111/status na.elf File opened for reading /proc/683/status na.elf File opened for reading /proc/727/status na.elf File opened for reading /proc/3/status na.elf File opened for reading /proc/5/status na.elf File opened for reading /proc/21/status na.elf File opened for reading /proc/83/status na.elf File opened for reading /proc/158/status na.elf File opened for reading /proc/346/status na.elf File opened for reading /proc/396/status na.elf File opened for reading /proc/22/status na.elf File opened for reading /proc/67/status na.elf File opened for reading /proc/686/status na.elf File opened for reading /proc/718/status na.elf File opened for reading /proc/720/status na.elf File opened for reading /proc/75/status na.elf File opened for reading /proc/15/status na.elf File opened for reading /proc/84/status na.elf File opened for reading /proc/8/status na.elf File opened for reading /proc/9/status na.elf File opened for reading /proc/13/status na.elf File opened for reading /proc/23/status na.elf File opened for reading /proc/125/status na.elf File opened for reading /proc/251/status na.elf File opened for reading /proc/4/status na.elf File opened for reading /proc/12/status na.elf File opened for reading /proc/150/status na.elf File opened for reading /proc/18/status na.elf File opened for reading /proc/77/status na.elf File opened for reading /proc/78/status na.elf File opened for reading /proc/390/status na.elf File opened for reading /proc/392/status na.elf File opened for reading /proc/10/status na.elf File opened for reading /proc/337/status na.elf File opened for reading /proc/701/status na.elf File opened for reading /proc/724/status na.elf File opened for reading /proc/1/status na.elf File opened for reading /proc/6/status na.elf File opened for reading /proc/37/status na.elf