Analysis
- max time kernel
124s - max time network
146s - platform
debian-12_armhf - resource
debian12-armhf-20240221-en - resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
19/10/2024, 01:15
Static task
static1
Behavioral task
behavioral1
Sample
23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
6 signatures
150 seconds
General
- Target 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf
- Size 77KB
- Sample241019-bmal9azfmn
- SHA256 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0
- MD5 d2c3556a910e0370ecd3997cfd8b8f69
- SHA1 b220577b9ac4ff9a662bd4a66ba3c4fff878c253
- SHA512 e6715854ef515cf1537307bc588790f75df7487fe0e28329a425bb616b409f8a0282555bc2367eed6faad074e34043ff4f95b97c441e5ecfa011c177e713cc8c
- SSDEEP 1536:4knqHa4G6ttLf/M34isELdcLCZIUVnDpXA+Rh8ml8RiaR9FmmIrx:q64G6tt4IidceyUVnDtA+A5R9FhIrx
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for modification /dev/misc/watchdog 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf - Renames itself 2 IoCs
pid Process 709 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf 709 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf - Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 161.97.219.84 Destination IP 54.36.111.116 - Reads process memory 1 TTPs 13 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/22/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/55/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/66/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/88/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/111/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/222/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/555/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/11/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/33/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/44/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/77/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/333/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/444/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself telnetd 709 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf -
description ioc Process File opened for reading /proc/6666�:/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/7777A;/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/22228;/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/2222S4/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/6666�:/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/7777B;/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/222c�/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/333�/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/2222�3/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/3333�4/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/33335/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/66667/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/6666 8/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/7777/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/99ssh/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/3333fffffff/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/3333�4/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/444d�/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/6666>;/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/222l�/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/222v�/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/333�/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/333s�/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/1111X0/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/11117;/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/3333�4/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/3333 5/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/111t/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/111cz/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/111c|/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/6666;/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/77774;/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/555s�/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/777k�/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/3333:5/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/7777?;/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/111j/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/222~/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/222m�/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/3333}4/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/6666 8/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/6666=;/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/111ur/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/11116;/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/1111�2/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/3333R5/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/3333g7/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/7777@;/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/7777C;/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/222�/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/333s�/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf File opened for reading /proc/1111�/maps 23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0.elf