dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9

Analysis

max time kernel
149s
max time network
152s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
13-11-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
Size

106KB
MD5

0ba4d5e0b8979db40263569d0a00e0ea
SHA1

1d123fc6b2f6815946985fa882469e84a29eb8c7
SHA256

dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9
SHA512

4d4078481680290e5fa7e00f9b677e12ef2b0bdd40be212f455d0f865233099aa6fce15c9d8a3c298affa492c972b04945165c68a72bb468caa58ffc1e1c756e
SSDEEP

1536:mNK/DoMWrTnIEb9An4SBSBCrGTHdp9Z/+eaz0HN:mNK/MMWrR9bOcHdjckN

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (23992) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for modification	/dev/misc/watchdog	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf

Reads runtime system information 18 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/662/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/674/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/722/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/729/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/779/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/824/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/660/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/716/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/783/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/711/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/698/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/791/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/426/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/717/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/718/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/721/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/793/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
File opened for reading	/proc/664/smaps	dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf

/tmp/dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
/tmp/dedb091ebd4b77f40694fe37f58b72b8347e8ea06f6c4b10d741db28230a2cd9.elf
1⤵
- Modifies Watchdog functionality
- Reads runtime system information
PID:719

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads