5825d7a03ea63068933673326764e841443069bc31a08c0673126ffbd11ab24b

Analysis

max time kernel
142s
max time network
144s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
21-10-2024 12:31

Target

dss.elf
Size

135KB
MD5

5060a76f8425c5e7f32acf691922de08
SHA1

42799ad5614cd481ce9b9ce5deb782b40747579f
SHA256

5825d7a03ea63068933673326764e841443069bc31a08c0673126ffbd11ab24b
SHA512

5994d9a6041abd5c02bcf80835fc00136ac15ea7560f93a96bc9dc61ca30db3dc0fb504a90efdbca8d120df54eedb3cef3c8d26c218526094c4f5a53b013ad8e
SSDEEP

3072:6ql/0Y5lBv69HsWF5ewSFplGkMItIy8ImTQNIQXc7H:aWvcMtXplGkRtIy8ImTQNIGc7H

Score

7^/10

defense_evasion

Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
defense_evasion

Impair Defenses
T1562

Processes:

dss.elf

description ioc process

File opened for modification /dev/watchdog dss.elf
File opened for modification /dev/misc/watchdog dss.elf
Changes its process name 1 IoCs

Processes:

dss.elf

description pid process

Changes the process name, possibly in an attempt to hide itself 656 dss.elf

description	ioc	process
File opened for modification	/dev/watchdog	dss.elf
File opened for modification	/dev/misc/watchdog	dss.elf

description	pid	process
Changes the process name, possibly in an attempt to hide itself	656	dss.elf

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact