717f1fddbcfbd5d5506df38a405ac48b7981f69142487872eac852fa99ca56af | Triage

Analysis

max time kernel
153s
max time network
165s
platform
debian-12_mipsel
resource
debian12-mipsel-20240221-en
resource tags

arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
17-10-2024 21:34

Sharing

Report Analysis Logs

General

Target

7209c718ddf39f028abf416886aab355.elf
Size

173KB
MD5

7209c718ddf39f028abf416886aab355
SHA1

5123cc7fed883a954bd13bb3d1d9489bd9bc5f67
SHA256

717f1fddbcfbd5d5506df38a405ac48b7981f69142487872eac852fa99ca56af
SHA512

982e9b4c603f0e116684278e9ad1e3979ef418ef8655e7ce2dd49dd5d1aa00b1ef41fa3c773e2dc51c5d36f9c4054c295c00f58d8d26a6c4ea21422aaa97ccac
SSDEEP

3072:nKpzGeeNkSfcQqmav8SqaRVlnYz65XVt:nKYeeNYQqmeqavlg65X

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
740	7209c718ddf39f028abf416886aab355.elf

Traces itself 2 IoCs

Traces itself to prevent debugging attempts

pid	Process
740	7209c718ddf39f028abf416886aab355.elf
742	7209c718ddf39f028abf416886aab355.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	740	7209c718ddf39f028abf416886aab355.elf

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/7209c718ddf39f028abf416886aab355.elf	7209c718ddf39f028abf416886aab355.elf

/tmp/7209c718ddf39f028abf416886aab355.elf
/tmp/7209c718ddf39f028abf416886aab355.elf
1⤵
- Deletes itself
- Traces itself
- Changes its process name
- Writes file to tmp directory
PID:740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads