8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2

General

Target

8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
Size

65KB
MD5

16d77c46f40723575ff92b080a29ab41
SHA1

ee58b7c8380cbe910d40c460695712db3a8ce6ea
SHA256

8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2
SHA512

97119c04639ac4339f3177fd8ff518997f6d424677c6a357148f9c4e67ba61bb1c7cde8631b20f6f11e6d0fede1164d4be87f620bd6cf24ee647e9801d3c9ecc
SSDEEP

1536:qvTKB+Q1jGAW8EX18d/DzS8X7rb7/aU0Ub:4Tuh1jRWlQ/Dz/X7r/aU0Ub

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (76771) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

Processes:

8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf

description	ioc	process
File opened for modification	/dev/watchdog	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for modification	/dev/misc/watchdog	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

Processes:

8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	2472	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf

description	ioc	process
File opened for reading	/proc/1879/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/2231/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1125/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1689/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/49/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/441/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1048/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1054/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1060/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1085/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/18/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/24/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/2294/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/2206/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/2257/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1764/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1877/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1953/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1985/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/2120/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/39/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/196/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/746/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/2480/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/792/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1944/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1986/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/2235/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/2470/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/7/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/40/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/198/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1917/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/2471/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/2505/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/25/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/27/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/31/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/190/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1931/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1996/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/3/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/19/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/192/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/789/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1063/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1687/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/2270/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/16/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/41/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/779/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1070/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1091/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/1858/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/2126/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/2192/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/20/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/510/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/2290/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/46/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/51/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/63/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/194/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
File opened for reading	/proc/195/cmdline	8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf

/tmp/8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
/tmp/8bfab2040d743cc37f4f8e68f5b3b71c4579ef01ed5bf8ea427e80933c22c6a2.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
- Reads runtime system information
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads