78c9f80697df7bb4152b5602f74b9fb519ecb5f9937e1b4810bcb9346411a2eb

General

Target

ub8ehJSePAfc9FYqZIT6.arm7.elf
Size

155KB
MD5

8b0ae426f2d0a6355e2c5ee8fad587db
SHA1

89604fd8577b6142812b9d4d186126c791f1b496
SHA256

78c9f80697df7bb4152b5602f74b9fb519ecb5f9937e1b4810bcb9346411a2eb
SHA512

4c77827772cd2549c977bdd65d26e0558927e985f79ac7f0087ef86a568837a3c87bd9449fc65d04cea59da596559b990424f921a9f475914e6e662a0968ab71
SSDEEP

3072:w0jlwv74BRae/xGPZ06v/mYp+C9T6MjYHDjyoM/9Rv03:w0jlwyRae/xGPd/z+cT6OYHDj1M/9V03

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

Processes:

ub8ehJSePAfc9FYqZIT6.arm7.elf

description	ioc	process
File opened for modification	/dev/watchdog	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for modification	/dev/misc/watchdog	ub8ehJSePAfc9FYqZIT6.arm7.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

Processes:

ub8ehJSePAfc9FYqZIT6.arm7.elf

description	ioc	process
File opened for modification	/sbin/watchdog	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for modification	/bin/watchdog	ub8ehJSePAfc9FYqZIT6.arm7.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

ub8ehJSePAfc9FYqZIT6.arm7.elf

description	ioc	process
File opened for reading	/proc/25/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/110/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/142/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/588/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/604/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/657/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/18/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/152/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/650/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/261/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/295/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/24/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/29/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/79/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/203/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/266/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/20/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/652/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/11/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/2/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/15/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/27/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/338/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/10/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/26/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/171/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/598/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/649/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/108/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/603/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/5/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/7/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/9/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/16/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/21/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/111/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/298/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/19/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/41/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/154/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/262/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/267/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/595/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/643/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/1/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/4/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/6/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/14/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/28/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/42/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/8/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/101/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/13/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/281/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/660/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/12/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/17/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/23/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/140/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/305/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/656/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/3/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/22/status	ub8ehJSePAfc9FYqZIT6.arm7.elf
File opened for reading	/proc/43/status	ub8ehJSePAfc9FYqZIT6.arm7.elf

/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:657

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads