Analysis
-
max time kernel
150s -
max time network
188s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
18-10-2024 01:50
Static task
static1
Behavioral task
behavioral1
Sample
610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
5 signatures
150 seconds
General
-
Target
610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf
-
Size
146KB
-
MD5
9041805feaeaa1989d463ffbfee62eca
-
SHA1
c54616d2e58665bbe415fa08c3ba5a24ca290edc
-
SHA256
610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939
-
SHA512
d8417a23ca31a9a04f4fa033c15f1829851e5270cf39ede3e18eb605a758cc1125e24e37689bf62a9681e320131ab36937c2516ff3e1f3a4ea43d74f6d90ab72
-
SSDEEP
3072:JOwuPl4D7+tPO5Kj9C7ZC2OweSa5KDGlLTsExUlL+O/FtjTQ/:jA4D7+tPPBC1C2VeSa5KDGlLT9GkONte
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 722 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for modification /dev/misc/watchdog 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 6 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself MAIN 712 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf Changes the process name, possibly in an attempt to hide itself ESI 718 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf Changes the process name, possibly in an attempt to hide itself MUSHI_KILLER 720 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf Changes the process name, possibly in an attempt to hide itself LOCKER 722 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf Changes the process name, possibly in an attempt to hide itself CONNECTION 725 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf Changes the process name, possibly in an attempt to hide itself CONNECTION 728 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf -
description ioc Process File opened for reading /proc/22/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/326/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/746/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/752/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/46/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/341/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/713/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/5/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/26/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/45/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/738/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/769/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/10/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/666/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/721/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/757/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/763/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/686/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/731/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/734/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/760/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/767/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/768/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/33/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/144/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/344/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/751/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/29/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/35/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/717/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/729/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/740/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/748/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/52/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/754/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/14/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/23/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/32/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/747/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/58/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/250/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/733/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/4/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/21/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/355/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/222/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/727/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/758/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/38/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/74/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/764/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/745/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/17/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/36/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/685/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/708/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/750/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/3/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/24/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/28/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/9/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/31/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/739/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf File opened for reading /proc/324/cmdline 610370adad558b4cb664a771fd24a659f66fd92a0db750c5ef76edecdb12c939.elf