Analysis
-
max time kernel
151s -
max time network
155s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240418-en -
resource tags
arch:mipselimage:debian12-mipsel-20240418-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
08-11-2024 09:24
Behavioral task
behavioral1
Sample
linux_mipsel_softfloat.elf
Resource
debian12-mipsel-20240418-en
General
-
Target
linux_mipsel_softfloat.elf
-
Size
5.6MB
-
MD5
6ea82095eee896f2b4100d8491218f4a
-
SHA1
6c3be3d799d342265897140c81e8b744d430e3b9
-
SHA256
4c65f49d6a7b360b0492ee41273fb1c6223d2771286740d1a7f91ee921dce0dd
-
SHA512
e870c93be276682ef32f0a2f11c0f5f5477bbd1159399ebf13b2c1a42101e9614fb17c9f242527ac3b823e2f47a13b8c28060aa5669581d7c65bc9af6eb5e4ae
-
SSDEEP
49152:+RxVVRFMTwbupkYzfgh7rxQ2USaU85Jbq1rQcR6VYv0VF1:
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
32678ioc pid process /etc/32678 771 32678 -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
linux_mipsel_softfloat.elfdescription ioc process File opened for modification /dev/watchdog linux_mipsel_softfloat.elf File opened for modification /dev/misc/watchdog linux_mipsel_softfloat.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
linux_mipsel_softfloat.elfdescription ioc process File opened for modification /etc/init.d/linux_kill linux_mipsel_softfloat.elf -
Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
Processes:
linux_mipsel_softfloat.elfdescription ioc process File opened for modification /usr/lib/systemd/system/linux.service linux_mipsel_softfloat.elf -
Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
linux_mipsel_softfloat.elflinux_mipsel_softfloat.elfdescription ioc process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size linux_mipsel_softfloat.elf File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size linux_mipsel_softfloat.elf -
Processes:
linux_mipsel_softfloat.elfsystemctljournalctlaudit2allowsedsystemctldescription ioc process File opened for reading /proc/713/stat linux_mipsel_softfloat.elf File opened for reading /proc/815/stat linux_mipsel_softfloat.elf File opened for reading /proc/866/stat linux_mipsel_softfloat.elf File opened for reading /proc/711/stat linux_mipsel_softfloat.elf File opened for reading /proc/807/stat linux_mipsel_softfloat.elf File opened for reading /proc/827/stat linux_mipsel_softfloat.elf File opened for reading /proc/882/stat linux_mipsel_softfloat.elf File opened for reading /proc/890/stat linux_mipsel_softfloat.elf File opened for reading /proc/828/stat linux_mipsel_softfloat.elf File opened for reading /proc/896/stat linux_mipsel_softfloat.elf File opened for reading /proc/879/stat linux_mipsel_softfloat.elf File opened for reading /proc/897/stat linux_mipsel_softfloat.elf File opened for reading /proc/801/stat linux_mipsel_softfloat.elf File opened for reading /proc/829/stat linux_mipsel_softfloat.elf File opened for reading /proc/852/stat linux_mipsel_softfloat.elf File opened for reading /proc/894/stat linux_mipsel_softfloat.elf File opened for reading /proc/356/stat linux_mipsel_softfloat.elf File opened for reading /proc/771/stat linux_mipsel_softfloat.elf File opened for reading /proc/881/stat linux_mipsel_softfloat.elf File opened for reading /proc/810/stat linux_mipsel_softfloat.elf File opened for reading /proc/796/stat linux_mipsel_softfloat.elf File opened for reading /proc/824/stat linux_mipsel_softfloat.elf File opened for reading /proc/836/stat linux_mipsel_softfloat.elf File opened for reading /proc/785/stat linux_mipsel_softfloat.elf File opened for reading /proc/755/stat linux_mipsel_softfloat.elf File opened for reading /proc/filesystems systemctl File opened for reading /proc/sys/kernel/cap_last_cap journalctl File opened for reading /proc/877/stat linux_mipsel_softfloat.elf File opened for reading /proc/filesystems audit2allow File opened for reading /proc/692/stat linux_mipsel_softfloat.elf File opened for reading /proc/800/stat linux_mipsel_softfloat.elf File opened for reading /proc/833/stat linux_mipsel_softfloat.elf File opened for reading /proc/818/stat linux_mipsel_softfloat.elf File opened for reading /proc/844/stat linux_mipsel_softfloat.elf File opened for reading /proc/filesystems sed File opened for reading /proc/403/stat linux_mipsel_softfloat.elf File opened for reading /proc/695/stat linux_mipsel_softfloat.elf File opened for reading /proc/816/stat linux_mipsel_softfloat.elf File opened for reading /proc/673/stat linux_mipsel_softfloat.elf File opened for reading /proc/853/stat linux_mipsel_softfloat.elf File opened for reading /proc/799/stat linux_mipsel_softfloat.elf File opened for reading /proc/874/stat linux_mipsel_softfloat.elf File opened for reading /proc/394/stat linux_mipsel_softfloat.elf File opened for reading /proc/735/stat linux_mipsel_softfloat.elf File opened for reading /proc/782/stat linux_mipsel_softfloat.elf File opened for reading /proc/720/stat linux_mipsel_softfloat.elf File opened for reading /proc/780/stat linux_mipsel_softfloat.elf File opened for reading /proc/888/stat linux_mipsel_softfloat.elf File opened for reading /proc/835/stat linux_mipsel_softfloat.elf File opened for reading /proc/845/stat linux_mipsel_softfloat.elf File opened for reading /proc/768/stat linux_mipsel_softfloat.elf File opened for reading /proc/811/stat linux_mipsel_softfloat.elf File opened for reading /proc/814/stat linux_mipsel_softfloat.elf File opened for reading /proc/318/stat linux_mipsel_softfloat.elf File opened for reading /proc/672/stat linux_mipsel_softfloat.elf File opened for reading /proc/sys/kernel/random/boot_id journalctl File opened for reading /proc/825/stat linux_mipsel_softfloat.elf File opened for reading /proc/839/stat linux_mipsel_softfloat.elf File opened for reading /proc/849/stat linux_mipsel_softfloat.elf File opened for reading /proc/filesystems systemctl File opened for reading /proc/384/stat linux_mipsel_softfloat.elf File opened for reading /proc/678/stat linux_mipsel_softfloat.elf File opened for reading /proc/805/stat linux_mipsel_softfloat.elf File opened for reading /proc/851/stat linux_mipsel_softfloat.elf -
System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
Processes:
linux_mipsel_softfloat.elflinux_mipsel_softfloat.elfpid process 744 linux_mipsel_softfloat.elf 769 linux_mipsel_softfloat.elf
Processes
-
/tmp/linux_mipsel_softfloat.elf/tmp/linux_mipsel_softfloat.elf1⤵
- Enumerates kernel/hardware configuration
- System Network Configuration Discovery
PID:744 -
/usr/bin/shsh -c "/etc/32678&"2⤵PID:767
-
/etc/32678/etc/326783⤵
- Executes dropped EXE
PID:771 -
/usr/bin/sleepsleep 604⤵PID:777
-
-
-
-
/usr/sbin/serviceservice crond start2⤵PID:768
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:772
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:779
-
-
/usr/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Reads runtime system information
PID:781
-
-
/usr/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵
- Reads runtime system information
PID:782
-
-
-
/tmp/linux_mipsel_softfloat.elf/tmp/linux_mipsel_softfloat.elf " "2⤵
- Modifies Watchdog functionality
- Modifies init.d
- Modifies systemd
- Enumerates kernel/hardware configuration
- Reads runtime system information
- System Network Configuration Discovery
PID:769 -
/usr/sbin/update-rc.dupdate-rc.d linux_kill defaults3⤵PID:790
-
/usr/local/sbin/systemctlsystemctl daemon-reload4⤵PID:801
-
-
/usr/local/bin/systemctlsystemctl daemon-reload4⤵PID:801
-
-
/usr/sbin/systemctlsystemctl daemon-reload4⤵PID:801
-
-
/usr/bin/systemctlsystemctl daemon-reload4⤵PID:801
-
-
-
/usr/bin/shsh -c "cd /boot;systemctl daemon-reload;systemctl enable linux.service;systemctl start linux.service;journalctl -xe --no-pager"3⤵PID:824
-
/usr/bin/systemctlsystemctl daemon-reload4⤵PID:825
-
-
/usr/bin/systemctlsystemctl enable linux.service4⤵PID:841
-
-
/usr/bin/systemctlsystemctl start linux.service4⤵
- Reads runtime system information
PID:859
-
-
/usr/bin/journalctljournalctl -xe --no-pager4⤵
- Reads runtime system information
PID:872
-
-
-
/usr/bin/shsh -c "cd /boot;ausearch -c 'System.img.conf' --raw | audit2allow -M my-Systemimgconf;semodule -X 300 -i my-Systemimgconf.pp"3⤵PID:879
-
/usr/sbin/ausearchausearch -c System.img.conf --raw4⤵PID:880
-
-
/usr/bin/audit2allowaudit2allow -M my-Systemimgconf4⤵
- Reads runtime system information
PID:881
-
-
-
-
/usr/local/sbin/systemctlsystemctl start crond.service1⤵PID:768
-
/usr/local/bin/systemctlsystemctl start crond.service1⤵PID:768
-
/usr/sbin/systemctlsystemctl start crond.service1⤵PID:768
-
/usr/bin/systemctlsystemctl start crond.service1⤵PID:768
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61B
MD5768eaf287796da19e1cf5e0b2fb1b161
SHA16a1ce2ee5ccc86d1f33806feb14547b35290df2a
SHA2561d22620dfb2a6715e5d745aed5cf841ede0e75e1747f12b9b925a2d346bc7ecb
SHA512e6af30c9df4f7f47696069511e64ecbc8e841629d692ee4056503df3533fb7a7a74960698826260355e1dba7b6c562482a27a39bb51a4237473ce4b68472d620
-
Filesize
189B
MD53909975f7cc0d1121c1819b800069f31
SHA13e68de708c2e6c40fab6794afdee3104e5590189
SHA2566876dac71f13a068afb863d257134275f2edba43b2acaf4924fabf97c079070b
SHA51250600cceeb03b05f45ae61d890caee9f51ff390b6776930866e527e071d65d08241fc66673fd9b99d62fbc77d3c00fc3de4d7378cbc42f5daba5d83072b0906e