eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58

General

Target

eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
Size

65KB
MD5

320bc2bd5e111c902f38d7951078a612
SHA1

b8d929de93c4469da90c2921f44ddfe72fa747db
SHA256

eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58
SHA512

f8c5666cd9edbf8cb37dff117ef23934d4fced958a83e9fb3aed04a98bd0b2a348154bae3875957c5e1e690bd4cfe1784017eea7517669f45cb6295367d6bd19
SSDEEP

1536:pftZEdHSalejzJmWGr6ZT5typgHU/8t465kVIcj:pftMRicW0/842kVIc

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (77275) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

Processes:

eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf

description	ioc	process
File opened for modification	/dev/watchdog	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for modification	/dev/misc/watchdog	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

Processes:

eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	652	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf

description	ioc	process
File opened for reading	/proc/18/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/763/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/780/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/15/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/271/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/305/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/580/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/734/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/22/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/115/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/276/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/774/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/784/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/5/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/19/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/113/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/145/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/289/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/638/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/17/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/148/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/155/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/273/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/278/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/594/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/10/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/28/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/162/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/322/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/782/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/14/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/24/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/43/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/598/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/650/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/6/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/8/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/16/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/23/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/600/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/649/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/4/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/12/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/20/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/27/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/41/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/104/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/647/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/761/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/770/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/3/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/13/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/116/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/651/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/655/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/2/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/768/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/26/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/601/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/644/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/772/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/786/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/9/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
File opened for reading	/proc/778/cmdline	eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf

/tmp/eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
/tmp/eedf3b8d7bddcd100dfb1c6be7da0fc4c3065d7e61cb885ed6c6263e11abff58.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
- Reads runtime system information
PID:652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads