Analysis
-
max time kernel
149s -
max time network
183s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
12-11-2024 10:41
Behavioral task
behavioral1
Sample
66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf
Resource
debian9-armhf-20240611-en
General
-
Target
66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf
-
Size
130KB
-
MD5
c64270111458e29ab78e09aedd5e7806
-
SHA1
ecc060d80168b1523603706ec1cff03d084d6639
-
SHA256
66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68
-
SHA512
014ff2e0c8e40e3552a6fac1610a2a2e19c1ef68ccb0b980dedf4106fbc1277e5dfbfd23b6995aa5c6704035998c06454c3990b8e3c518b0ae51d9def39015cc
-
SSDEEP
3072:exAlz/Ae377xw4Fw1+eRYTEhrdFxfdgDM/9KOkGU:E0jAeL7JFw1+eKQhpfd4M/9KhGU
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elfdescription ioc Process File opened for modification /dev/watchdog 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for modification /dev/misc/watchdog 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 30 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
Processes:
66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elfdescription ioc Process File opened for reading /proc/669/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/641/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/654/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/599/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/602/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/766/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/768/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/595/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/717/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/659/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/785/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/783/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/787/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/789/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/793/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/765/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/779/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/652/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/653/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/729/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/773/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/781/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/601/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/647/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/721/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/775/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/791/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/581/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/657/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf File opened for reading /proc/777/maps 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf -
Changes its process name 1 IoCs
Processes:
66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elfdescription ioc pid Process Changes the process name, possibly in an attempt to hide itself a 655 66c8a4f5d7545e468edfe848609a9a2fd8e7aeb7a85f3fdda70674034b13eb68.elf