Analysis
-
max time kernel
150s -
max time network
156s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240729-en -
resource tags
arch:mipselimage:debian12-mipsel-20240729-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
18-10-2024 02:51
Behavioral task
behavioral1
Sample
d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d.elf
Resource
debian12-mipsel-20240729-en
debian-12-mipsel
2 signatures
150 seconds
General
-
Target
d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d.elf
-
Size
176KB
-
MD5
a12f73595ac151704a731bbca8ff2180
-
SHA1
6070bdd09ff0ae162104d9f43fd0eed53dbcef20
-
SHA256
d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d
-
SHA512
12563cfd996548036d1c7ca36dff67377167e668d469dd29dd1cbf2b84a324fcc68a78201b9ee260765ba84bd33dd5e608713323e75e1cc9a9bf2f3206224560
-
SSDEEP
1536:O4ejx3x6/r5/FQF56rRR6/rYcmw+tp07LQiU65eip4dimmeBy/mdanKs6cSH:Oz1/cZw+t+v8iWiEy/m0nKs6cSH
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d.elfdescription ioc process File opened for modification /dev/watchdog d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d.elf File opened for modification /dev/misc/watchdog d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d.elf -
Changes its process name 1 IoCs
Processes:
d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d.elfdescription pid process Changes the process name, possibly in an attempt to hide itself 738 d6cea53172ee89d84858a2d30ed3cb0f00b6be251b990be10732d01659048d5d.elf