Analysis
-
max time kernel
107s -
max time network
140s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
31/10/2024, 03:45
Behavioral task
behavioral1
Sample
89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf
Resource
debian9-mipsbe-20240611-en
General
-
Target
89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf
-
Size
134KB
-
MD5
427f083bb7bc46726fe406312ad16896
-
SHA1
1d2e85a5bb7adfc0abf8a723c3f2c9733ffb122d
-
SHA256
89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26
-
SHA512
23ffff9458069f166380ee71a5311a0de205ef73795ea0cab101dc7c941771ef42c1adf66424354ce2d26aff4e29f1c7c2e9be7b61aace3695645cde657c0710
-
SSDEEP
3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6coG:7O/QJHZweEL/NOjCHm7FZZncP
Malware Config
Signatures
-
Contacts a large (8078) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule behavioral1/files/fstream-3.dat patched_upx -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog 89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf File opened for modification /dev/watchdog 89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/S95baby.sh 89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf -
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route 89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf File opened for modification /bin/watchdog 89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf -
resource yara_rule behavioral1/files/fstream-3.dat upx -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself sshd 699 89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf -
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf File opened for reading /proc/net/raw 89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf File opened for reading /proc/net/route 89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf -
description ioc Process File opened for reading /proc/3/stat killall File opened for reading /proc/9/stat killall File opened for reading /proc/141/stat killall File opened for reading /proc/694/stat killall File opened for reading /proc/self/exe 89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf File opened for reading /proc/13/stat killall File opened for reading /proc/18/stat killall File opened for reading /proc/162/stat killall File opened for reading /proc/4/stat killall File opened for reading /proc/12/stat killall File opened for reading /proc/112/cmdline killall File opened for reading /proc/228/stat killall File opened for reading /proc/699/stat killall File opened for reading /proc/487/stat killall File opened for reading /proc/706/stat killall File opened for reading /proc/filesystems killall File opened for reading /proc/15/stat killall File opened for reading /proc/24/stat killall File opened for reading /proc/74/stat killall File opened for reading /proc/328/stat killall File opened for reading /proc/71/stat killall File opened for reading /proc/mounts 89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf File opened for reading /proc/147/stat killall File opened for reading /proc/700/stat killall File opened for reading /proc/2/stat killall File opened for reading /proc/72/stat killall File opened for reading /proc/73/stat killall File opened for reading /proc/75/stat killall File opened for reading /proc/141/cmdline killall File opened for reading /proc/22/stat killall File opened for reading /proc/101/stat killall File opened for reading /proc/701/stat killall File opened for reading /proc/5/stat killall File opened for reading /proc/8/stat killall File opened for reading /proc/16/stat killall File opened for reading /proc/77/stat killall File opened for reading /proc/372/stat killall File opened for reading /proc/17/stat killall File opened for reading /proc/20/stat killall File opened for reading /proc/23/stat killall File opened for reading /proc/37/stat killall File opened for reading /proc/70/stat killall File opened for reading /proc/36/stat killall File opened for reading /proc/450/stat killall File opened for reading /proc/699/cmdline killall File opened for reading /proc/11/stat killall File opened for reading /proc/111/stat killall File opened for reading /proc/317/stat killall File opened for reading /proc/388/stat killall File opened for reading /proc/689/stat killall File opened for reading /proc/696/stat killall File opened for reading /proc/6/stat killall File opened for reading /proc/21/stat killall File opened for reading /proc/76/stat killall File opened for reading /proc/371/stat killall File opened for reading /proc/486/stat killall File opened for reading /proc/320/stat killall File opened for reading /proc/457/stat killall File opened for reading /proc/676/stat killall File opened for reading /proc/10/stat killall File opened for reading /proc/19/stat killall File opened for reading /proc/80/stat killall File opened for reading /proc/695/stat killall File opened for reading /proc/7/stat killall -
System Network Configuration Discovery 1 TTPs 18 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 766 sh 809 sh 812 sh 817 sh 828 sh 742 sh 756 sh 764 sh 772 sh 774 sh 782 sh 792 sh 834 sh 770 sh 784 sh 786 sh 798 sh 826 sh -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.ips 89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf
Processes
-
/tmp/89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf/tmp/89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Modifies init.d
- Reads system routing table
- Writes file to system bin folder
- Changes its process name
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:697 -
/bin/shsh -c "killall -9 telnetd utelnetd scfgmgr"2⤵PID:700
-
/usr/bin/killallkillall -9 telnetd utelnetd scfgmgr3⤵
- Reads runtime system information
PID:705
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --destination-port 48573 -j ACCEPT"2⤵PID:738
-
/sbin/iptablesiptables -I INPUT -p tcp --destination-port 48573 -j ACCEPT3⤵PID:739
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --source-port 48573 -j ACCEPT"2⤵
- System Network Configuration Discovery
PID:742 -
/sbin/iptablesiptables -I OUTPUT -p tcp --source-port 48573 -j ACCEPT3⤵PID:745
-
-
-
/bin/shsh -c "iptables -I PREROUTING -t nat -p tcp --destination-port 48573 -j ACCEPT"2⤵PID:746
-
/sbin/iptablesiptables -I PREROUTING -t nat -p tcp --destination-port 48573 -j ACCEPT3⤵PID:747
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --destination-port 22 -j DROP"2⤵PID:748
-
/sbin/iptablesiptables -I INPUT -p tcp --destination-port 22 -j DROP3⤵PID:751
-
-
-
/bin/shsh -c "iptables -I POSTROUTING -t nat -p tcp --source-port 48573 -j ACCEPT"2⤵
- System Network Configuration Discovery
PID:756 -
/sbin/iptablesiptables -I POSTROUTING -t nat -p tcp --source-port 48573 -j ACCEPT3⤵PID:757
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --destination-port 23 -j DROP"2⤵PID:758
-
/sbin/iptablesiptables -I INPUT -p tcp --destination-port 23 -j DROP3⤵PID:759
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --dport 48573 -j ACCEPT"2⤵PID:760
-
/sbin/iptablesiptables -I INPUT -p tcp --dport 48573 -j ACCEPT3⤵PID:761
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --destination-port 2323 -j DROP"2⤵PID:762
-
/sbin/iptablesiptables -I INPUT -p tcp --destination-port 2323 -j DROP3⤵PID:763
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --sport 48573 -j ACCEPT"2⤵
- System Network Configuration Discovery
PID:764 -
/sbin/iptablesiptables -I OUTPUT -p tcp --sport 48573 -j ACCEPT3⤵PID:765
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --source-port 22 -j DROP"2⤵
- System Network Configuration Discovery
PID:766 -
/sbin/iptablesiptables -I OUTPUT -p tcp --source-port 22 -j DROP3⤵PID:767
-
-
-
/bin/shsh -c "iptables -I PREROUTING -t nat -p tcp --dport 48573 -j ACCEPT"2⤵PID:768
-
/sbin/iptablesiptables -I PREROUTING -t nat -p tcp --dport 48573 -j ACCEPT3⤵PID:769
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --source-port 23 -j DROP"2⤵
- System Network Configuration Discovery
PID:770 -
/sbin/iptablesiptables -I OUTPUT -p tcp --source-port 23 -j DROP3⤵PID:771
-
-
-
/bin/shsh -c "iptables -I POSTROUTING -t nat -p tcp --sport 48573 -j ACCEPT"2⤵
- System Network Configuration Discovery
PID:772 -
/sbin/iptablesiptables -I POSTROUTING -t nat -p tcp --sport 48573 -j ACCEPT3⤵PID:773
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --source-port 2323 -j DROP"2⤵
- System Network Configuration Discovery
PID:774 -
/sbin/iptablesiptables -I OUTPUT -p tcp --source-port 2323 -j DROP3⤵PID:775
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --dport 22 -j DROP"2⤵PID:776
-
/sbin/iptablesiptables -I INPUT -p tcp --dport 22 -j DROP3⤵PID:777
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --dport 23 -j DROP"2⤵PID:778
-
/sbin/iptablesiptables -I INPUT -p tcp --dport 23 -j DROP3⤵PID:779
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --dport 2323 -j DROP"2⤵PID:780
-
/sbin/iptablesiptables -I INPUT -p tcp --dport 2323 -j DROP3⤵PID:781
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --sport 22 -j DROP"2⤵
- System Network Configuration Discovery
PID:782 -
/sbin/iptablesiptables -I OUTPUT -p tcp --sport 22 -j DROP3⤵PID:783
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --sport 23 -j DROP"2⤵
- System Network Configuration Discovery
PID:784 -
/sbin/iptablesiptables -I OUTPUT -p tcp --sport 23 -j DROP3⤵PID:785
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --sport 2323 -j DROP"2⤵
- System Network Configuration Discovery
PID:786 -
/sbin/iptablesiptables -I OUTPUT -p tcp --sport 2323 -j DROP3⤵PID:787
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --destination-port 58000 -j DROP"2⤵PID:789
-
/sbin/iptablesiptables -I INPUT -p tcp --destination-port 58000 -j DROP3⤵PID:791
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --source-port 58000 -j DROP"2⤵
- System Network Configuration Discovery
PID:792 -
/sbin/iptablesiptables -I OUTPUT -p tcp --source-port 58000 -j DROP3⤵PID:794
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --dport 58000 -j DROP"2⤵PID:795
-
/sbin/iptablesiptables -I INPUT -p tcp --dport 58000 -j DROP3⤵PID:797
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --sport 58000 -j DROP"2⤵
- System Network Configuration Discovery
PID:798 -
/sbin/iptablesiptables -I OUTPUT -p tcp --sport 58000 -j DROP3⤵PID:799
-
-
-
/bin/shsh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer URL \"http://127.0.0.1\""2⤵PID:801
-
-
/bin/shsh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer ConnectionRequestPassword \"acsMozi\""2⤵PID:802
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --destination-port 35000 -j DROP"2⤵PID:804
-
/sbin/iptablesiptables -I INPUT -p tcp --destination-port 35000 -j DROP3⤵PID:805
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --destination-port 50023 -j DROP"2⤵PID:806
-
/sbin/iptablesiptables -I INPUT -p tcp --destination-port 50023 -j DROP3⤵PID:807
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --source-port 50023 -j DROP"2⤵
- System Network Configuration Discovery
PID:809 -
/sbin/iptablesiptables -I OUTPUT -p tcp --source-port 50023 -j DROP3⤵PID:810
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --source-port 35000 -j DROP"2⤵
- System Network Configuration Discovery
PID:812 -
/sbin/iptablesiptables -I OUTPUT -p tcp --source-port 35000 -j DROP3⤵PID:813
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --destination-port 7547 -j DROP"2⤵PID:814
-
/sbin/iptablesiptables -I INPUT -p tcp --destination-port 7547 -j DROP3⤵PID:815
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --source-port 7547 -j DROP"2⤵
- System Network Configuration Discovery
PID:817 -
/sbin/iptablesiptables -I OUTPUT -p tcp --source-port 7547 -j DROP3⤵PID:818
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --dport 35000 -j DROP"2⤵PID:820
-
/sbin/iptablesiptables -I INPUT -p tcp --dport 35000 -j DROP3⤵PID:821
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --dport 50023 -j DROP"2⤵PID:822
-
/sbin/iptablesiptables -I INPUT -p tcp --dport 50023 -j DROP3⤵PID:823
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --sport 50023 -j DROP"2⤵
- System Network Configuration Discovery
PID:826 -
/sbin/iptablesiptables -I OUTPUT -p tcp --sport 50023 -j DROP3⤵PID:827
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --sport 35000 -j DROP"2⤵
- System Network Configuration Discovery
PID:828 -
/sbin/iptablesiptables -I OUTPUT -p tcp --sport 35000 -j DROP3⤵PID:829
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --dport 7547 -j DROP"2⤵PID:831
-
/sbin/iptablesiptables -I INPUT -p tcp --dport 7547 -j DROP3⤵PID:832
-
-
-
/bin/shsh -c "iptables -I OUTPUT -p tcp --sport 7547 -j DROP"2⤵
- System Network Configuration Discovery
PID:834 -
/sbin/iptablesiptables -I OUTPUT -p tcp --sport 7547 -j DROP3⤵PID:835
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD51b3235ba10fc04836c941d3d27301956
SHA18909655763143702430b8c58b3ae3b04cfd3a29c
SHA25601ba1fb41632594997a41d0c3a911ae5b3034d566ebb991ef76ad76e6f9e283a
SHA51298bdb5c266222ccbd63b6f80c87e501c8033dc53b0513d300b8da50e39a207a0b69f8cd3ecc4a128dec340a1186779fedd1049c9b0a70e90d2cb3ae6ebfa4c4d
-
Filesize
134KB
MD5427f083bb7bc46726fe406312ad16896
SHA11d2e85a5bb7adfc0abf8a723c3f2c9733ffb122d
SHA25689d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26
SHA51223ffff9458069f166380ee71a5311a0de205ef73795ea0cab101dc7c941771ef42c1adf66424354ce2d26aff4e29f1c7c2e9be7b61aace3695645cde657c0710