0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/11/2024, 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
Size

163KB
MD5

fee06c31fd25bdfd971c5a35c31ac4b5
SHA1

2abdba915d86cc16754360b9d4536fed1bd1236c
SHA256

0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3
SHA512

58c51a8a8e402427e4c92a68b60fd1b1e76558ca9f0b75d5bde2eef4dbb5d1abae06ef0caa75094de9ef935a49194f8d0ad082cd3026002a7ad8fa92877460b4
SSDEEP

3072:sYReNV2Bsb5s3fa8vM1a+vyJ+Lfnzjsp+T4CUM/9MoDhkilJM:sY0NEC2fa8vM1a+m+/4p+TuM/9XDzJM

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (23993) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for modification	/dev/misc/watchdog	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 30 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/643/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/779/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/706/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/773/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/648/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/769/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/581/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/637/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/631/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/756/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/588/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/598/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/763/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/771/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/777/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/781/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/644/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/761/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/642/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/710/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/718/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/584/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/587/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/767/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/775/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/655/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/754/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/774/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/647/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
File opened for reading	/proc/765/smaps	0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf

/tmp/0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
/tmp/0c6ade258e6c07b31b300ef0bf9752354ce8252e875c487f0420a758e85ad6e3.elf
1⤵
- Modifies Watchdog functionality
- Reads runtime system information
PID:645

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads