Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
14-11-2024 08:16
Static task
static1
Behavioral task
behavioral1
Sample
la.bot.arm6.elf
Resource
debian9-armhf-20240418-en
General
-
Target
la.bot.arm6.elf
-
Size
85KB
-
MD5
8212dd5e396935db46ae6f21299a0d9b
-
SHA1
f36b2f6e85e06efe85f36dccc6bdac71120e2c7c
-
SHA256
9a48652f0afe3252fa8998bbb80e08269e62866e2d3ad98cc77180b9ef3ac7ca
-
SHA512
02001d75da3af4df9c1b833fb8dfa9874f37e0e85d17fd51c1bf1b32aedebf7745bfadb94827afa60b0c3f5891e9ff47af23d6e376965b17c50073fde136e599
-
SSDEEP
1536:2Pn4Ye94U9acvAXxtv3gPtRf+S5DEpDYdm7u0GbAOkGg7MKiU4RJ3ndvnzsTu2:tYeza2AXxtv3/S9EpDYUkbg4RJ3ndvn
Malware Config
Signatures
-
Contacts a large (33900) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
la.bot.arm6.elfdescription ioc Process File opened for modification /dev/watchdog la.bot.arm6.elf File opened for modification /dev/misc/watchdog la.bot.arm6.elf -
Renames itself 1 IoCs
Processes:
la.bot.arm6.elfpid Process 645 la.bot.arm6.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 168.138.12.137 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
la.bot.arm6.elfdescription ioc Process File opened for reading /proc/net/tcp la.bot.arm6.elf -
Reads process memory 1 TTPs 11 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
Processes:
la.bot.arm6.elfdescription ioc Process File opened for reading /proc/22/maps la.bot.arm6.elf File opened for reading /proc/33/maps la.bot.arm6.elf File opened for reading /proc/44/maps la.bot.arm6.elf File opened for reading /proc/77/maps la.bot.arm6.elf File opened for reading /proc/99/maps la.bot.arm6.elf File opened for reading /proc/111/maps la.bot.arm6.elf File opened for reading /proc/444/maps la.bot.arm6.elf File opened for reading /proc/11/maps la.bot.arm6.elf File opened for reading /proc/55/maps la.bot.arm6.elf File opened for reading /proc/66/maps la.bot.arm6.elf File opened for reading /proc/222/maps la.bot.arm6.elf -
Changes its process name 13 IoCs
Processes:
la.bot.arm6.elfdescription ioc pid Process Changes the process name, possibly in an attempt to hide itself boa 645 la.bot.arm6.elf Changes the process name, possibly in an attempt to hide itself boa 648 la.bot.arm6.elf Changes the process name, possibly in an attempt to hide itself udhcpc 648 la.bot.arm6.elf Changes the process name, possibly in an attempt to hide itself udhcpc 648 la.bot.arm6.elf Changes the process name, possibly in an attempt to hide itself /usr/bin/inetd 648 la.bot.arm6.elf Changes the process name, possibly in an attempt to hide itself httpd 648 la.bot.arm6.elf Changes the process name, possibly in an attempt to hide itself httpd 648 la.bot.arm6.elf Changes the process name, possibly in an attempt to hide itself telnetd 648 la.bot.arm6.elf Changes the process name, possibly in an attempt to hide itself upnpc-static 648 la.bot.arm6.elf Changes the process name, possibly in an attempt to hide itself httpd 648 la.bot.arm6.elf Changes the process name, possibly in an attempt to hide itself /usr/bin/inetd 648 la.bot.arm6.elf Changes the process name, possibly in an attempt to hide itself udhcpc 648 la.bot.arm6.elf Changes the process name, possibly in an attempt to hide itself upnpc-static 648 la.bot.arm6.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
la.bot.arm6.elfdescription ioc Process File opened for reading /proc/net/tcp la.bot.arm6.elf -
Processes:
la.bot.arm6.elfdescription ioc Process File opened for reading /proc/111m�"/maps la.bot.arm6.elf File opened for reading /proc/1111�"/fd la.bot.arm6.elf File opened for reading /proc/6666x5/fd la.bot.arm6.elf File opened for reading /proc/33/fd la.bot.arm6.elf File opened for reading /proc/222/fd la.bot.arm6.elf File opened for reading /proc/111c�"/maps la.bot.arm6.elf File opened for reading /proc/222�"/maps la.bot.arm6.elf File opened for reading /proc/1111m(/fd la.bot.arm6.elf File opened for reading /proc/111c�"/fd la.bot.arm6.elf File opened for reading /proc/111c�"/fd la.bot.arm6.elf File opened for reading /proc/1111�"/fd la.bot.arm6.elf File opened for reading /proc/6666�3/maps la.bot.arm6.elf File opened for reading /proc/111�"/fd la.bot.arm6.elf File opened for reading /proc/1111�%/fd la.bot.arm6.elf File opened for reading /proc/2222*/fd la.bot.arm6.elf File opened for reading /proc/2222,/fd la.bot.arm6.elf File opened for reading /proc/55550/fd la.bot.arm6.elf File opened for reading /proc/666674/maps la.bot.arm6.elf File opened for reading /proc/6666:4/maps la.bot.arm6.elf File opened for reading /proc/111�"/fd la.bot.arm6.elf File opened for reading /proc/44/fd la.bot.arm6.elf File opened for reading /proc/1111�,/fd la.bot.arm6.elf File opened for reading /proc/6666�>/fd la.bot.arm6.elf File opened for reading /proc/1111�,/fd la.bot.arm6.elf File opened for reading /proc/22222*/fd la.bot.arm6.elf File opened for reading /proc/5555�0/fd la.bot.arm6.elf File opened for reading /proc/777s�"/maps la.bot.arm6.elf File opened for reading /proc/22/fd la.bot.arm6.elf File opened for reading /proc/2222k*/fd la.bot.arm6.elf File opened for reading /proc/6666�3/fd la.bot.arm6.elf File opened for reading /proc/1111<#/maps la.bot.arm6.elf File opened for reading /proc/55550/maps la.bot.arm6.elf File opened for reading /proc/6666�3/maps la.bot.arm6.elf File opened for reading /proc/222�"/fd la.bot.arm6.elf File opened for reading /proc/2222�)/maps la.bot.arm6.elf File opened for reading /proc/2222�*/maps la.bot.arm6.elf File opened for reading /proc/5555[0/maps la.bot.arm6.elf File opened for reading /proc/3333/maps la.bot.arm6.elf File opened for reading /proc/5555�0/maps la.bot.arm6.elf File opened for reading /proc/999�"/maps la.bot.arm6.elf File opened for reading /proc/88ll�"/fd la.bot.arm6.elf File opened for reading /proc/6666�>/fd la.bot.arm6.elf File opened for reading /proc/444s�"/fd la.bot.arm6.elf File opened for reading /proc/77779/fd la.bot.arm6.elf File opened for reading /proc/5555�0/fd la.bot.arm6.elf File opened for reading /proc/222s�"/maps la.bot.arm6.elf File opened for reading /proc/2222�*/maps la.bot.arm6.elf File opened for reading /proc/666694/maps la.bot.arm6.elf File opened for reading /proc/666684/fd la.bot.arm6.elf File opened for reading /proc/6666D4/fd la.bot.arm6.elf File opened for reading /proc/1111�"/maps la.bot.arm6.elf File opened for reading /proc/77/fd la.bot.arm6.elf File opened for reading /proc/2222",/fd la.bot.arm6.elf File opened for reading /proc/777s�"/fd la.bot.arm6.elf File opened for reading /proc/111c�"/maps la.bot.arm6.elf File opened for reading /proc/2222",/maps la.bot.arm6.elf File opened for reading /proc/222v�"/fd la.bot.arm6.elf File opened for reading /proc/66/fd la.bot.arm6.elf File opened for reading /proc/6666�3/fd la.bot.arm6.elf File opened for reading /proc/444s�"/maps la.bot.arm6.elf File opened for reading /proc/1111m(/maps la.bot.arm6.elf File opened for reading /proc/333364/maps la.bot.arm6.elf File opened for reading /proc/111/fd la.bot.arm6.elf File opened for reading /proc/2222�)/fd la.bot.arm6.elf