f8754a8280f98a8f15a4992f5771fc63da182bacaea589facd8914f2ad6e5192

Analysis

max time kernel
152s
max time network
165s
platform
debian-12_mipsel
resource
debian12-mipsel-20240221-en
resource tags

arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
21/11/2024, 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8754a8280f98a8f15a4992f5771fc63da182bacaea589facd8914f2ad6e5192.elf
Size

17KB
MD5

a14e34af2ca3a15b5172fa3dc8482878
SHA1

2e6d2e95e0f7a6e36b9e934762e516d7846b94cd
SHA256

f8754a8280f98a8f15a4992f5771fc63da182bacaea589facd8914f2ad6e5192
SHA512

cdd2fd84db7e29a58007be9a7d7b5b56fe1c40b4fd92cb78644db59d3687ccc670d30b81106c2fdd9e38f42f9526ba9221b9cdd4dbf495fc9fcb1dc0701af069
SSDEEP

384:IMtYARypnxXWhrVMB6Y7SaL9lYgVgHAq8RTANMNbyFjwJq3l2B5v:vIVxXUgSev2HAXRTk4yW4k5v

Score

7^/10

defense_evasion

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	f8754a8280f98a8f15a4992f5771fc63da182bacaea589facd8914f2ad6e5192.elf
File opened for modification	/dev/watchdog	f8754a8280f98a8f15a4992f5771fc63da182bacaea589facd8914f2ad6e5192.elf

Renames itself 1 IoCs

pid	Process
743	f8754a8280f98a8f15a4992f5771fc63da182bacaea589facd8914f2ad6e5192.elf

Unexpected DNS network traffic destination 43 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	217.160.70.42
Destination IP	217.160.70.42
Destination IP	51.254.162.59
Destination IP	217.160.70.42
Destination IP	81.169.136.222
Destination IP	5.161.109.23
Destination IP	137.220.55.93
Destination IP	217.160.70.42
Destination IP	5.161.109.23
Destination IP	51.158.108.203
Destination IP	137.220.55.93
Destination IP	51.158.108.203
Destination IP	95.216.99.249
Destination IP	51.158.108.203
Destination IP	81.169.136.222
Destination IP	51.254.162.59
Destination IP	51.158.108.203
Destination IP	137.220.55.93
Destination IP	178.254.22.166
Destination IP	178.254.22.166
Destination IP	139.84.165.176
Destination IP	64.176.6.48
Destination IP	178.254.22.166
Destination IP	152.53.15.127
Destination IP	51.158.108.203
Destination IP	51.254.162.59
Destination IP	185.232.68.212
Destination IP	65.21.1.106
Destination IP	168.235.111.72
Destination IP	95.216.99.249
Destination IP	51.254.162.59
Destination IP	5.161.109.23
Destination IP	217.160.70.42
Destination IP	64.176.6.48
Destination IP	5.161.109.23
Destination IP	152.53.15.127
Destination IP	81.169.136.222
Destination IP	81.169.136.222
Destination IP	64.176.6.48
Destination IP	178.254.22.166
Destination IP	152.53.15.127
Destination IP	168.235.111.72
Destination IP	152.53.15.127

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	743	f8754a8280f98a8f15a4992f5771fc63da182bacaea589facd8914f2ad6e5192.elf

/tmp/f8754a8280f98a8f15a4992f5771fc63da182bacaea589facd8914f2ad6e5192.elf
/tmp/f8754a8280f98a8f15a4992f5771fc63da182bacaea589facd8914f2ad6e5192.elf
1⤵
- Modifies Watchdog functionality
- Renames itself
- Changes its process name
PID:743

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads