d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d

Analysis

max time kernel
150s
max time network
156s
platform
debian-12_mipsel
resource
debian12-mipsel-20240729-en
resource tags

arch:mipselimage:debian12-mipsel-20240729-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
18-10-2024 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d.elf
Size

176KB
MD5

a12f73595ac151704a731bbca8ff2180
SHA1

6070bdd09ff0ae162104d9f43fd0eed53dbcef20
SHA256

d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d
SHA512

12563cfd996548036d1c7ca36dff67377167e668d469dd29dd1cbf2b84a324fcc68a78201b9ee260765ba84bd33dd5e608713323e75e1cc9a9bf2f3206224560
SSDEEP

1536:O4ejx3x6/r5/FQF56rRR6/rYcmw+tp07LQiU65eip4dimmeBy/mdanKs6cSH:Oz1/cZw+t+v8iWiEy/m0nKs6cSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

Processes:

d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d.elf

description	ioc	process
File opened for modification	/dev/watchdog	d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d.elf
File opened for modification	/dev/misc/watchdog	d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d.elf

Changes its process name 1 IoCs

Processes:

d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d.elf

description	pid	process
Changes the process name, possibly in an attempt to hide itself	738	d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d.elf

/tmp/d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d.elf
/tmp/d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
PID:738

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads