Analysis
-
max time kernel
148s -
max time network
150s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
14-11-2024 02:24
Behavioral task
behavioral1
Sample
501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
4 signatures
150 seconds
General
-
Target
501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf
-
Size
96KB
-
MD5
50764748025fde68ca734cbb0dbb7d5f
-
SHA1
44cde5575433851efe7453f2e16e70eb6d550b36
-
SHA256
501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef
-
SHA512
ebef93a907d6a08a164d8cbf8694fcb9e6132b559abc80b8a6a2d401725ec06b8761b588a25458083f35f588bcf86dd3d07a6b7ba40c49314cdf95048eb86e19
-
SSDEEP
1536:nXnpuoZnZ4N5Q029rn5bzi1ARLBKUY4mYhbyMOrlcDZlmcKqF36riFNYIGYVKWdR:MSaNNcJBB3Ir2ZlmcKMFN1DUEJ
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for modification /dev/misc/watchdog 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for modification /bin/watchdog 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf -
description ioc Process File opened for reading /proc/286/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/599/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/16/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/29/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/108/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/98/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/27/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/145/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/267/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/636/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/1/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/5/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/20/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/138/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/149/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/642/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/647/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/13/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/76/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/137/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/266/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/18/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/105/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/212/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/637/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/644/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/4/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/41/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/147/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/107/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/271/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/312/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/596/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/643/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/24/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/26/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/43/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/166/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/2/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/22/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/25/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/21/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/300/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/19/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/630/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/9/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/10/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/15/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/3/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/287/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/303/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/28/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/42/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/639/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/6/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/11/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/17/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/578/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/593/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/598/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/641/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/7/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/8/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf File opened for reading /proc/14/status 501f1c58d1f02c1509ce69b664eee87f9a810ea9da36dd2dae8dfde57b2830ef.elf