3271bbdb49f6a5a4ad4cba1256e4805d1ada650f36e0086259bd9ab7d39f4667

Analysis

max time kernel
149s
max time network
151s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240522.1-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
21/11/2024, 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3271bbdb49f6a5a4ad4cba1256e4805d1ada650f36e0086259bd9ab7d39f4667.elf
Size

64KB
MD5

d75ffd62da3b5eb4fe3338a07522b57f
SHA1

ebd1de41f2c916e6ea2fa012b29115cb915bebe9
SHA256

3271bbdb49f6a5a4ad4cba1256e4805d1ada650f36e0086259bd9ab7d39f4667
SHA512

22d8031c08c4b9366d20abc26e8f1f4dcde7ac7b89990c04f152bed3b81e185947bfe259df3018baad726145767d9d36fc0cd8a3303792cc42b5f37d680ba606
SSDEEP

1536:v8fIhfwui9pfcS6xGQvmgd5NXJwuIu52oR3z:I6M99cXGwXJwuP5Rdz

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (76764) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	3271bbdb49f6a5a4ad4cba1256e4805d1ada650f36e0086259bd9ab7d39f4667.elf
File opened for modification	/dev/misc/watchdog	3271bbdb49f6a5a4ad4cba1256e4805d1ada650f36e0086259bd9ab7d39f4667.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1569	3271bbdb49f6a5a4ad4cba1256e4805d1ada650f36e0086259bd9ab7d39f4667.elf

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/	3271bbdb49f6a5a4ad4cba1256e4805d1ada650f36e0086259bd9ab7d39f4667.elf

/tmp/3271bbdb49f6a5a4ad4cba1256e4805d1ada650f36e0086259bd9ab7d39f4667.elf
/tmp/3271bbdb49f6a5a4ad4cba1256e4805d1ada650f36e0086259bd9ab7d39f4667.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
- Reads runtime system information
PID:1569

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads