Analysis

  • max time kernel
    107s
  • max time network
    140s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240611-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    31/10/2024, 03:45

General

  • Target

    89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf

  • Size

    134KB

  • MD5

    427f083bb7bc46726fe406312ad16896

  • SHA1

    1d2e85a5bb7adfc0abf8a723c3f2c9733ffb122d

  • SHA256

    89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26

  • SHA512

    23ffff9458069f166380ee71a5311a0de205ef73795ea0cab101dc7c941771ef42c1adf66424354ce2d26aff4e29f1c7c2e9be7b61aace3695645cde657c0710

  • SSDEEP

    3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6coG:7O/QJHZweEL/NOjCHm7FZZncP

Malware Config

Signatures

  • Contacts a large (8078) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

  • Writes file to system bin folder 2 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Changes its process name 1 IoCs
  • Reads system network configuration 1 TTPs 3 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 18 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf
    /tmp/89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26.elf
    1⤵
    • Modifies Watchdog functionality
    • Enumerates active TCP sockets
    • Modifies init.d
    • Reads system routing table
    • Writes file to system bin folder
    • Changes its process name
    • Reads system network configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:697
    • /bin/sh
      sh -c "killall -9 telnetd utelnetd scfgmgr"
      2⤵
        PID:700
        • /usr/bin/killall
          killall -9 telnetd utelnetd scfgmgr
          3⤵
          • Reads runtime system information
          PID:705
      • /bin/sh
        sh -c "iptables -I INPUT -p tcp --destination-port 48573 -j ACCEPT"
        2⤵
          PID:738
          • /sbin/iptables
            iptables -I INPUT -p tcp --destination-port 48573 -j ACCEPT
            3⤵
              PID:739
          • /bin/sh
            sh -c "iptables -I OUTPUT -p tcp --source-port 48573 -j ACCEPT"
            2⤵
            • System Network Configuration Discovery
            PID:742
            • /sbin/iptables
              iptables -I OUTPUT -p tcp --source-port 48573 -j ACCEPT
              3⤵
                PID:745
            • /bin/sh
              sh -c "iptables -I PREROUTING -t nat -p tcp --destination-port 48573 -j ACCEPT"
              2⤵
                PID:746
                • /sbin/iptables
                  iptables -I PREROUTING -t nat -p tcp --destination-port 48573 -j ACCEPT
                  3⤵
                    PID:747
                • /bin/sh
                  sh -c "iptables -I INPUT -p tcp --destination-port 22 -j DROP"
                  2⤵
                    PID:748
                    • /sbin/iptables
                      iptables -I INPUT -p tcp --destination-port 22 -j DROP
                      3⤵
                        PID:751
                    • /bin/sh
                      sh -c "iptables -I POSTROUTING -t nat -p tcp --source-port 48573 -j ACCEPT"
                      2⤵
                      • System Network Configuration Discovery
                      PID:756
                      • /sbin/iptables
                        iptables -I POSTROUTING -t nat -p tcp --source-port 48573 -j ACCEPT
                        3⤵
                          PID:757
                      • /bin/sh
                        sh -c "iptables -I INPUT -p tcp --destination-port 23 -j DROP"
                        2⤵
                          PID:758
                          • /sbin/iptables
                            iptables -I INPUT -p tcp --destination-port 23 -j DROP
                            3⤵
                              PID:759
                          • /bin/sh
                            sh -c "iptables -I INPUT -p tcp --dport 48573 -j ACCEPT"
                            2⤵
                              PID:760
                              • /sbin/iptables
                                iptables -I INPUT -p tcp --dport 48573 -j ACCEPT
                                3⤵
                                  PID:761
                              • /bin/sh
                                sh -c "iptables -I INPUT -p tcp --destination-port 2323 -j DROP"
                                2⤵
                                  PID:762
                                  • /sbin/iptables
                                    iptables -I INPUT -p tcp --destination-port 2323 -j DROP
                                    3⤵
                                      PID:763
                                  • /bin/sh
                                    sh -c "iptables -I OUTPUT -p tcp --sport 48573 -j ACCEPT"
                                    2⤵
                                    • System Network Configuration Discovery
                                    PID:764
                                    • /sbin/iptables
                                      iptables -I OUTPUT -p tcp --sport 48573 -j ACCEPT
                                      3⤵
                                        PID:765
                                    • /bin/sh
                                      sh -c "iptables -I OUTPUT -p tcp --source-port 22 -j DROP"
                                      2⤵
                                      • System Network Configuration Discovery
                                      PID:766
                                      • /sbin/iptables
                                        iptables -I OUTPUT -p tcp --source-port 22 -j DROP
                                        3⤵
                                          PID:767
                                      • /bin/sh
                                        sh -c "iptables -I PREROUTING -t nat -p tcp --dport 48573 -j ACCEPT"
                                        2⤵
                                          PID:768
                                          • /sbin/iptables
                                            iptables -I PREROUTING -t nat -p tcp --dport 48573 -j ACCEPT
                                            3⤵
                                              PID:769
                                          • /bin/sh
                                            sh -c "iptables -I OUTPUT -p tcp --source-port 23 -j DROP"
                                            2⤵
                                            • System Network Configuration Discovery
                                            PID:770
                                            • /sbin/iptables
                                              iptables -I OUTPUT -p tcp --source-port 23 -j DROP
                                              3⤵
                                                PID:771
                                            • /bin/sh
                                              sh -c "iptables -I POSTROUTING -t nat -p tcp --sport 48573 -j ACCEPT"
                                              2⤵
                                              • System Network Configuration Discovery
                                              PID:772
                                              • /sbin/iptables
                                                iptables -I POSTROUTING -t nat -p tcp --sport 48573 -j ACCEPT
                                                3⤵
                                                  PID:773
                                              • /bin/sh
                                                sh -c "iptables -I OUTPUT -p tcp --source-port 2323 -j DROP"
                                                2⤵
                                                • System Network Configuration Discovery
                                                PID:774
                                                • /sbin/iptables
                                                  iptables -I OUTPUT -p tcp --source-port 2323 -j DROP
                                                  3⤵
                                                    PID:775
                                                • /bin/sh
                                                  sh -c "iptables -I INPUT -p tcp --dport 22 -j DROP"
                                                  2⤵
                                                    PID:776
                                                    • /sbin/iptables
                                                      iptables -I INPUT -p tcp --dport 22 -j DROP
                                                      3⤵
                                                        PID:777
                                                    • /bin/sh
                                                      sh -c "iptables -I INPUT -p tcp --dport 23 -j DROP"
                                                      2⤵
                                                        PID:778
                                                        • /sbin/iptables
                                                          iptables -I INPUT -p tcp --dport 23 -j DROP
                                                          3⤵
                                                            PID:779
                                                        • /bin/sh
                                                          sh -c "iptables -I INPUT -p tcp --dport 2323 -j DROP"
                                                          2⤵
                                                            PID:780
                                                            • /sbin/iptables
                                                              iptables -I INPUT -p tcp --dport 2323 -j DROP
                                                              3⤵
                                                                PID:781
                                                            • /bin/sh
                                                              sh -c "iptables -I OUTPUT -p tcp --sport 22 -j DROP"
                                                              2⤵
                                                              • System Network Configuration Discovery
                                                              PID:782
                                                              • /sbin/iptables
                                                                iptables -I OUTPUT -p tcp --sport 22 -j DROP
                                                                3⤵
                                                                  PID:783
                                                              • /bin/sh
                                                                sh -c "iptables -I OUTPUT -p tcp --sport 23 -j DROP"
                                                                2⤵
                                                                • System Network Configuration Discovery
                                                                PID:784
                                                                • /sbin/iptables
                                                                  iptables -I OUTPUT -p tcp --sport 23 -j DROP
                                                                  3⤵
                                                                    PID:785
                                                                • /bin/sh
                                                                  sh -c "iptables -I OUTPUT -p tcp --sport 2323 -j DROP"
                                                                  2⤵
                                                                  • System Network Configuration Discovery
                                                                  PID:786
                                                                  • /sbin/iptables
                                                                    iptables -I OUTPUT -p tcp --sport 2323 -j DROP
                                                                    3⤵
                                                                      PID:787
                                                                  • /bin/sh
                                                                    sh -c "iptables -I INPUT -p tcp --destination-port 58000 -j DROP"
                                                                    2⤵
                                                                      PID:789
                                                                      • /sbin/iptables
                                                                        iptables -I INPUT -p tcp --destination-port 58000 -j DROP
                                                                        3⤵
                                                                          PID:791
                                                                      • /bin/sh
                                                                        sh -c "iptables -I OUTPUT -p tcp --source-port 58000 -j DROP"
                                                                        2⤵
                                                                        • System Network Configuration Discovery
                                                                        PID:792
                                                                        • /sbin/iptables
                                                                          iptables -I OUTPUT -p tcp --source-port 58000 -j DROP
                                                                          3⤵
                                                                            PID:794
                                                                        • /bin/sh
                                                                          sh -c "iptables -I INPUT -p tcp --dport 58000 -j DROP"
                                                                          2⤵
                                                                            PID:795
                                                                            • /sbin/iptables
                                                                              iptables -I INPUT -p tcp --dport 58000 -j DROP
                                                                              3⤵
                                                                                PID:797
                                                                            • /bin/sh
                                                                              sh -c "iptables -I OUTPUT -p tcp --sport 58000 -j DROP"
                                                                              2⤵
                                                                              • System Network Configuration Discovery
                                                                              PID:798
                                                                              • /sbin/iptables
                                                                                iptables -I OUTPUT -p tcp --sport 58000 -j DROP
                                                                                3⤵
                                                                                  PID:799
                                                                              • /bin/sh
                                                                                sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer URL \"http://127.0.0.1\""
                                                                                2⤵
                                                                                  PID:801
                                                                                • /bin/sh
                                                                                  sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer ConnectionRequestPassword \"acsMozi\""
                                                                                  2⤵
                                                                                    PID:802
                                                                                  • /bin/sh
                                                                                    sh -c "iptables -I INPUT -p tcp --destination-port 35000 -j DROP"
                                                                                    2⤵
                                                                                      PID:804
                                                                                      • /sbin/iptables
                                                                                        iptables -I INPUT -p tcp --destination-port 35000 -j DROP
                                                                                        3⤵
                                                                                          PID:805
                                                                                      • /bin/sh
                                                                                        sh -c "iptables -I INPUT -p tcp --destination-port 50023 -j DROP"
                                                                                        2⤵
                                                                                          PID:806
                                                                                          • /sbin/iptables
                                                                                            iptables -I INPUT -p tcp --destination-port 50023 -j DROP
                                                                                            3⤵
                                                                                              PID:807
                                                                                          • /bin/sh
                                                                                            sh -c "iptables -I OUTPUT -p tcp --source-port 50023 -j DROP"
                                                                                            2⤵
                                                                                            • System Network Configuration Discovery
                                                                                            PID:809
                                                                                            • /sbin/iptables
                                                                                              iptables -I OUTPUT -p tcp --source-port 50023 -j DROP
                                                                                              3⤵
                                                                                                PID:810
                                                                                            • /bin/sh
                                                                                              sh -c "iptables -I OUTPUT -p tcp --source-port 35000 -j DROP"
                                                                                              2⤵
                                                                                              • System Network Configuration Discovery
                                                                                              PID:812
                                                                                              • /sbin/iptables
                                                                                                iptables -I OUTPUT -p tcp --source-port 35000 -j DROP
                                                                                                3⤵
                                                                                                  PID:813
                                                                                              • /bin/sh
                                                                                                sh -c "iptables -I INPUT -p tcp --destination-port 7547 -j DROP"
                                                                                                2⤵
                                                                                                  PID:814
                                                                                                  • /sbin/iptables
                                                                                                    iptables -I INPUT -p tcp --destination-port 7547 -j DROP
                                                                                                    3⤵
                                                                                                      PID:815
                                                                                                  • /bin/sh
                                                                                                    sh -c "iptables -I OUTPUT -p tcp --source-port 7547 -j DROP"
                                                                                                    2⤵
                                                                                                    • System Network Configuration Discovery
                                                                                                    PID:817
                                                                                                    • /sbin/iptables
                                                                                                      iptables -I OUTPUT -p tcp --source-port 7547 -j DROP
                                                                                                      3⤵
                                                                                                        PID:818
                                                                                                    • /bin/sh
                                                                                                      sh -c "iptables -I INPUT -p tcp --dport 35000 -j DROP"
                                                                                                      2⤵
                                                                                                        PID:820
                                                                                                        • /sbin/iptables
                                                                                                          iptables -I INPUT -p tcp --dport 35000 -j DROP
                                                                                                          3⤵
                                                                                                            PID:821
                                                                                                        • /bin/sh
                                                                                                          sh -c "iptables -I INPUT -p tcp --dport 50023 -j DROP"
                                                                                                          2⤵
                                                                                                            PID:822
                                                                                                            • /sbin/iptables
                                                                                                              iptables -I INPUT -p tcp --dport 50023 -j DROP
                                                                                                              3⤵
                                                                                                                PID:823
                                                                                                            • /bin/sh
                                                                                                              sh -c "iptables -I OUTPUT -p tcp --sport 50023 -j DROP"
                                                                                                              2⤵
                                                                                                              • System Network Configuration Discovery
                                                                                                              PID:826
                                                                                                              • /sbin/iptables
                                                                                                                iptables -I OUTPUT -p tcp --sport 50023 -j DROP
                                                                                                                3⤵
                                                                                                                  PID:827
                                                                                                              • /bin/sh
                                                                                                                sh -c "iptables -I OUTPUT -p tcp --sport 35000 -j DROP"
                                                                                                                2⤵
                                                                                                                • System Network Configuration Discovery
                                                                                                                PID:828
                                                                                                                • /sbin/iptables
                                                                                                                  iptables -I OUTPUT -p tcp --sport 35000 -j DROP
                                                                                                                  3⤵
                                                                                                                    PID:829
                                                                                                                • /bin/sh
                                                                                                                  sh -c "iptables -I INPUT -p tcp --dport 7547 -j DROP"
                                                                                                                  2⤵
                                                                                                                    PID:831
                                                                                                                    • /sbin/iptables
                                                                                                                      iptables -I INPUT -p tcp --dport 7547 -j DROP
                                                                                                                      3⤵
                                                                                                                        PID:832
                                                                                                                    • /bin/sh
                                                                                                                      sh -c "iptables -I OUTPUT -p tcp --sport 7547 -j DROP"
                                                                                                                      2⤵
                                                                                                                      • System Network Configuration Discovery
                                                                                                                      PID:834
                                                                                                                      • /sbin/iptables
                                                                                                                        iptables -I OUTPUT -p tcp --sport 7547 -j DROP
                                                                                                                        3⤵
                                                                                                                          PID:835

                                                                                                                    Network

                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          • /etc/rcS.d/S95baby.sh

                                                                                                                            Filesize

                                                                                                                            25B

                                                                                                                            MD5

                                                                                                                            1b3235ba10fc04836c941d3d27301956

                                                                                                                            SHA1

                                                                                                                            8909655763143702430b8c58b3ae3b04cfd3a29c

                                                                                                                            SHA256

                                                                                                                            01ba1fb41632594997a41d0c3a911ae5b3034d566ebb991ef76ad76e6f9e283a

                                                                                                                            SHA512

                                                                                                                            98bdb5c266222ccbd63b6f80c87e501c8033dc53b0513d300b8da50e39a207a0b69f8cd3ecc4a128dec340a1186779fedd1049c9b0a70e90d2cb3ae6ebfa4c4d

                                                                                                                          • /usr/networks

                                                                                                                            Filesize

                                                                                                                            134KB

                                                                                                                            MD5

                                                                                                                            427f083bb7bc46726fe406312ad16896

                                                                                                                            SHA1

                                                                                                                            1d2e85a5bb7adfc0abf8a723c3f2c9733ffb122d

                                                                                                                            SHA256

                                                                                                                            89d26c99d40482b571311bdfcd8db6647e3de70a19d51ba0d84f65f6f411bd26

                                                                                                                            SHA512

                                                                                                                            23ffff9458069f166380ee71a5311a0de205ef73795ea0cab101dc7c941771ef42c1adf66424354ce2d26aff4e29f1c7c2e9be7b61aace3695645cde657c0710