Analysis
-
max time kernel
139s -
max time network
160s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
13-11-2024 14:32
Behavioral task
behavioral1
Sample
ub8ehJSePAfc9FYqZIT6.arm6.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
4 signatures
150 seconds
General
-
Target
ub8ehJSePAfc9FYqZIT6.arm6.elf
-
Size
96KB
-
MD5
50764748025fde68ca734cbb0dbb7d5f
-
SHA1
44cde5575433851efe7453f2e16e70eb6d550b36
-
SHA256
501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef
-
SHA512
ebef93a907d6a08a164d8cbf8694fcb9e6132b559abc80b8a6a2d401725ec06b8761b588a25458083f35f588bcf86dd3d07a6b7ba40c49314cdf95048eb86e19
-
SSDEEP
1536:nXnpuoZnZ4N5Q029rn5bzi1ARLBKUY4mYhbyMOrlcDZlmcKqF36riFNYIGYVKWdR:MSaNNcJBB3Ir2ZlmcKMFN1DUEJ
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
ub8ehJSePAfc9FYqZIT6.arm6.elfdescription ioc Process File opened for modification /dev/watchdog ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for modification /dev/misc/watchdog ub8ehJSePAfc9FYqZIT6.arm6.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
Processes:
ub8ehJSePAfc9FYqZIT6.arm6.elfdescription ioc Process File opened for modification /sbin/watchdog ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for modification /bin/watchdog ub8ehJSePAfc9FYqZIT6.arm6.elf -
Processes:
ub8ehJSePAfc9FYqZIT6.arm6.elfdescription ioc Process File opened for reading /proc/19/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/26/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/5/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/51/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/322/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/2/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/16/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/678/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/22/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/23/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/315/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/251/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/310/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/326/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/344/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/662/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/17/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/31/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/45/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/705/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/355/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/14/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/18/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/34/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/1/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/8/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/187/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/699/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/713/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/4/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/57/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/142/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/201/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/221/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/340/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/342/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/704/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/9/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/21/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/28/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/143/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/208/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/710/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/10/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/20/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/44/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/13/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/33/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/56/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/665/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/709/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/29/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/36/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/73/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/701/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/708/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/12/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/32/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/316/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/30/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/46/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/646/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/3/status ub8ehJSePAfc9FYqZIT6.arm6.elf File opened for reading /proc/6/status ub8ehJSePAfc9FYqZIT6.arm6.elf