Analysis
-
max time kernel
151s -
max time network
157s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
04-11-2024 02:50
Static task
static1
Behavioral task
behavioral1
Sample
bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf
Resource
debian9-mipsbe-20240611-en
General
-
Target
bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf
-
Size
151KB
-
MD5
3c90d5820bddcf7c5d1bd21dfa49d958
-
SHA1
5ba05bd489e50af97d6dc45e3a0be60e494d5083
-
SHA256
bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2
-
SHA512
54a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a
-
SSDEEP
1536:mVqSjUF+uLHLVdiLzLsLzLsL7LeLGLXL0LLLkLhqqvZjptByZEGkbU+/pWacxZkI:tr9dy1B2gSpLg70mLjXswi5itRx2p
Malware Config
Signatures
-
Contacts a large (2169) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Renames itself 1 IoCs
Processes:
bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elfpid Process 693 bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc Process File opened for modification /var/spool/cron/crontabs/tmp.I8jqNO crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elfcrontabdescription ioc Process File opened for reading /proc/736/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/748/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/928/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/934/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/948/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/74/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/716/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/808/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/872/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/897/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/940/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/963/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/976/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/140/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/583/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/722/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/770/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/2/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/768/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/854/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/867/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/957/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/997/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/1000/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/73/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/228/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/754/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/760/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/810/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/832/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/981/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/22/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/385/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/918/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/708/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/785/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/1001/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/1053/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/149/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/530/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/689/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/805/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/859/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/995/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/1002/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/841/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/6/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/10/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/14/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/696/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/741/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/755/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/790/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/920/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/987/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/1033/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/72/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/320/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/filesystems crontab File opened for reading /proc/732/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/838/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/858/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/860/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf File opened for reading /proc/1036/cmdline bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf
Processes
-
/tmp/bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf/tmp/bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2.elf1⤵
- Renames itself
- Reads runtime system information
PID:692 -
/bin/shsh -c "crontab -l"2⤵PID:694
-
/usr/bin/crontabcrontab -l3⤵PID:696
-
-
-
/bin/shsh -c "crontab -"2⤵PID:704
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:706
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210B
MD59acb0d3f4eea71787e2dc7455a0c25c7
SHA1b68b658cf7b1f8efbe85ee3b5ece807c13c812ec
SHA256b4ebc1435e9101b8c0605a286f35a94c540762002f0ed51296747c63851c51b2
SHA5124a09bf599a5c3de55e67e5887ef27074e9b8ceb9db48ff551454a01f91edf246992e99f2cc10a77f17258b50898f5c58a2c0d48d31322288df9d95080f3e4d07