Analysis
-
max time kernel
154s -
max time network
168s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
05-11-2024 03:23
Behavioral task
behavioral1
Sample
63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf
Resource
debian12-mipsel-20240221-en
General
-
Target
63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf
-
Size
5.6MB
-
MD5
a588866d01919ba373464c54536b57a8
-
SHA1
1bff6f7edc7522ad35563b7998cb85bf7df09baf
-
SHA256
63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f
-
SHA512
f9743b778aa1fc11b7b95939ab613335b40c5cfbd45f640811af0cc55d22f18bb0a9f90fddbfc91efbfd4b67803d143962cd1a578b59fb0b827d68b405c06cfc
-
SSDEEP
98304:yC91hAFxvW6WGVqq7g3JDCg76dAuE8iW5ay5mIOX+aaNcc8pNkxXkz8xBs3K4HUj:yC91hAFxvW6WGVqq7g3JDCg76dAuE8iQ
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
32678id.services.confid.services.conf32678id.services.confioc pid process /etc/32678 767 32678 /etc/id.services.conf 825 id.services.conf /etc/id.services.conf 834 id.services.conf /etc/32678 835 32678 /etc/id.services.conf 877 id.services.conf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elfdescription ioc process File opened for modification /dev/watchdog 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for modification /dev/misc/watchdog 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elfdescription ioc process File opened for modification /etc/init.d/linux_kill 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf -
Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
Processes:
63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elfdescription ioc process File opened for modification /usr/lib/systemd/system/linux.service 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf -
Reads CPU attributes 1 TTPs 1 IoCs
Processes:
pkilldescription ioc process File opened for reading /sys/devices/system/cpu/possible pkill -
Enumerates kernel/hardware configuration 1 TTPs 6 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elfid.services.confpkillid.services.confid.services.confdescription ioc process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size id.services.conf File opened for reading /sys/devices/system/node pkill File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size id.services.conf File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size id.services.conf -
Processes:
pkill63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elfsystemctlsystemctldescription ioc process File opened for reading /proc/7/cgroup pkill File opened for reading /proc/26/cmdline pkill File opened for reading /proc/688/cmdline pkill File opened for reading /proc/113/ctty pkill File opened for reading /proc/825/ctty pkill File opened for reading /proc/2/cgroup pkill File opened for reading /proc/3/cmdline pkill File opened for reading /proc/13/status pkill File opened for reading /proc/27/status pkill File opened for reading /proc/31/cgroup pkill File opened for reading /proc/716/stat 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for reading /proc/5/status pkill File opened for reading /proc/53/ctty pkill File opened for reading /proc/655/cgroup pkill File opened for reading /proc/179/cmdline pkill File opened for reading /proc/791/stat 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for reading /proc/1/stat pkill File opened for reading /proc/8/cmdline pkill File opened for reading /proc/19/ctty pkill File opened for reading /proc/47/cgroup pkill File opened for reading /proc/774/stat 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for reading /proc/10/ctty pkill File opened for reading /proc/33/ctty pkill File opened for reading /proc/731/stat pkill File opened for reading /proc/692/cgroup pkill File opened for reading /proc/filesystems systemctl File opened for reading /proc/692/stat 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for reading /proc/42/cmdline pkill File opened for reading /proc/857/stat 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for reading /proc/414/stat 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for reading /proc/34/stat pkill File opened for reading /proc/179/ctty pkill File opened for reading /proc/692/cmdline pkill File opened for reading /proc/690/stat 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for reading /proc/27/cmdline pkill File opened for reading /proc/42/cgroup pkill File opened for reading /proc/53/cmdline pkill File opened for reading /proc/690/stat pkill File opened for reading /proc/876/stat 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for reading /proc/3/status pkill File opened for reading /proc/6/status pkill File opened for reading /proc/11/status pkill File opened for reading /proc/17/stat pkill File opened for reading /proc/412/ctty pkill File opened for reading /proc/3/cgroup pkill File opened for reading /proc/22/cmdline pkill File opened for reading /proc/29/cmdline pkill File opened for reading /proc/179/cgroup pkill File opened for reading /proc/865/stat 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for reading /proc/688/stat 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for reading /proc/3/stat pkill File opened for reading /proc/30/stat pkill File opened for reading /proc/829/status pkill File opened for reading /proc/848/stat 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for reading /proc/1/status pkill File opened for reading /proc/15/cmdline pkill File opened for reading /proc/863/stat 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for reading /proc/392/stat 63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf File opened for reading /proc/117/stat pkill File opened for reading /proc/655/stat pkill File opened for reading /proc/15/ctty pkill File opened for reading /proc/642/cmdline pkill File opened for reading /proc/716/stat pkill File opened for reading /proc/filesystems systemctl -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 10 Go-http-client/1.1
Processes
-
/tmp/63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf/tmp/63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf1⤵
- Enumerates kernel/hardware configuration
PID:741 -
/usr/bin/shsh -c "/etc/32678&"2⤵PID:763
-
-
/usr/sbin/serviceservice crond start2⤵PID:764
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:768
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:776
-
-
/usr/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵PID:779
-
-
/usr/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵PID:780
-
-
-
/tmp/63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf/tmp/63e389a3d5251cbeaaab08d5d0cad2b49226eb0764652c64d3f663f7ad8a393f.elf " "2⤵
- Modifies Watchdog functionality
- Modifies init.d
- Modifies systemd
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:766 -
/usr/sbin/update-rc.dupdate-rc.d linux_kill defaults3⤵PID:789
-
/usr/local/sbin/systemctlsystemctl daemon-reload4⤵PID:803
-
-
/usr/local/bin/systemctlsystemctl daemon-reload4⤵PID:803
-
-
/usr/sbin/systemctlsystemctl daemon-reload4⤵PID:803
-
-
/usr/bin/systemctlsystemctl daemon-reload4⤵PID:803
-
-
-
/usr/bin/shsh -c "cd /boot;systemctl daemon-reload;systemctl enable linux.service;systemctl start linux.service;journalctl -xe --no-pager"3⤵PID:830
-
/usr/bin/systemctlsystemctl daemon-reload4⤵PID:831
-
-
/usr/bin/systemctlsystemctl enable linux.service4⤵
- Reads runtime system information
PID:862
-
-
-
-
/etc/32678/etc/326781⤵
- Executes dropped EXE
PID:767 -
/usr/bin/sleepsleep 602⤵PID:774
-
-
/etc/id.services.conf/etc/id.services.conf2⤵
- Executes dropped EXE
- Enumerates kernel/hardware configuration
PID:825 -
/usr/bin/pkillpkill -9 326783⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:829
-
-
/usr/bin/shsh -c "/etc/32678&"3⤵PID:832
-
-
/usr/sbin/serviceservice crond start3⤵PID:833
-
/usr/bin/basenamebasename /usr/sbin/service4⤵PID:836
-
-
/usr/bin/basenamebasename /usr/sbin/service4⤵PID:838
-
-
/usr/bin/systemctlsystemctl list-unit-files --full "--type=socket"4⤵PID:842
-
-
/usr/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"4⤵PID:843
-
-
-
/etc/id.services.conf/etc/id.services.conf " "3⤵
- Executes dropped EXE
- Enumerates kernel/hardware configuration
PID:834
-
-
-
/usr/local/sbin/systemctlsystemctl start crond.service1⤵PID:764
-
/usr/local/bin/systemctlsystemctl start crond.service1⤵PID:764
-
/usr/sbin/systemctlsystemctl start crond.service1⤵PID:764
-
/usr/bin/systemctlsystemctl start crond.service1⤵PID:764
-
/etc/32678/etc/326781⤵
- Executes dropped EXE
PID:835 -
/usr/bin/sleepsleep 602⤵PID:837
-
-
/etc/id.services.conf/etc/id.services.conf2⤵
- Executes dropped EXE
- Enumerates kernel/hardware configuration
PID:877
-
-
/usr/local/sbin/systemctlsystemctl start crond.service1⤵PID:833
-
/usr/local/bin/systemctlsystemctl start crond.service1⤵PID:833
-
/usr/sbin/systemctlsystemctl start crond.service1⤵PID:833
-
/usr/bin/systemctlsystemctl start crond.service1⤵
- Reads runtime system information
PID:833
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61B
MD5768eaf287796da19e1cf5e0b2fb1b161
SHA16a1ce2ee5ccc86d1f33806feb14547b35290df2a
SHA2561d22620dfb2a6715e5d745aed5cf841ede0e75e1747f12b9b925a2d346bc7ecb
SHA512e6af30c9df4f7f47696069511e64ecbc8e841629d692ee4056503df3533fb7a7a74960698826260355e1dba7b6c562482a27a39bb51a4237473ce4b68472d620
-
Filesize
189B
MD53909975f7cc0d1121c1819b800069f31
SHA13e68de708c2e6c40fab6794afdee3104e5590189
SHA2566876dac71f13a068afb863d257134275f2edba43b2acaf4924fabf97c079070b
SHA51250600cceeb03b05f45ae61d890caee9f51ff390b6776930866e527e071d65d08241fc66673fd9b99d62fbc77d3c00fc3de4d7378cbc42f5daba5d83072b0906e