a85487c12e5a86dad5a98b0805e55f743572f70bfda9e11166278c71ca561763

General

Target

ub8ehJSePAfc9FYqZIT6.arm7.elf
Size

155KB
MD5

beebb0d6a9f7ce053ee9c42812b7fbe5
SHA1

68b89bb1e1564f372668eb04fdaf8e52b3741975
SHA256

a85487c12e5a86dad5a98b0805e55f743572f70bfda9e11166278c71ca561763
SHA512

ca8a76c286156691d3d91b116f5aa1b2d3bbc5f8da6fb40604614409d989dd601a4bf93ca99e878cf763d4e3321e9b3ecbf0f77bb03b8369a984fa449184eec0
SSDEEP

3072:w0jlwv74BRae/xGPZ06v/mYp+C9T6Mj1HDjyoM/9Rv03:w0jlwyRae/xGPd/z+cT6O1HDj1M/9V03

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

Processes:

ub8ehJSePAfc9FYqZIT6.arm7.elf

description	ioc	process
File opened for modification	/dev/watchdog	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for modification	/dev/misc/watchdog	ub8ehJSePAfc9FYqZIT6.arm7.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

Processes:

ub8ehJSePAfc9FYqZIT6.arm7.elf

description	ioc	process
File opened for modification	/sbin/watchdog	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for modification	/bin/watchdog	ub8ehJSePAfc9FYqZIT6.arm7.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

ub8ehJSePAfc9FYqZIT6.arm7.elf

description	ioc	process
File opened for reading	/proc/5/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/42/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/215/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/23/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/27/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/18/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/24/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/154/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/11/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/26/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/114/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/651/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/8/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/13/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/311/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/279/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/592/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/2/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/3/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/4/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/10/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/14/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/115/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/644/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/650/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/21/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/43/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/283/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/597/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/598/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/611/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/12/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/20/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/104/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/656/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/658/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/22/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/25/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/144/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/149/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/306/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/653/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/7/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/82/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/280/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/655/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/657/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/9/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/661/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/15/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/19/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/145/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/156/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/278/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/282/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/6/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/16/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/41/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/272/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/28/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/327/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/595/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/1/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/17/status	ub8ehJSePAfc9FYqZIT6.arm7.elf

/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:658

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads