Analysis
-
max time kernel
150s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
23-11-2024 07:25
Static task
static1
Behavioral task
behavioral1
Sample
la.bot.arm6.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
9 signatures
150 seconds
General
-
Target
la.bot.arm6.elf
-
Size
82KB
-
MD5
18e3b6c44321a244852ec122d7e9a3ff
-
SHA1
06c253e3d29b2e4053c674031c90997f8a70bd85
-
SHA256
4f78767c86f0714dfcb39d6b90af663277ed6fb60f3fcd8415d84c5e659cd915
-
SHA512
95d55033ea1a8dd2e93654060780978bb1336685802dc807a3151f4632160969f3eb485d903ada39814e2e605877bc26c968ccfe584ddf967cadd8e4c71c4403
-
SSDEEP
1536:R7nF1w3yMDwuotJIFcZt8HPDxiT9LLSmIdZS7yb/rV3X4M+izLT9kGAwknCnzsTa:71w37DpotmFcgDxiT9vSmIfaG/hLT9k6
Score
9/10
Malware Config
Signatures
-
Contacts a large (21103) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog la.bot.arm6.elf File opened for modification /dev/misc/watchdog la.bot.arm6.elf -
Renames itself 1 IoCs
pid Process 657 la.bot.arm6.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp la.bot.arm6.elf -
Reads process memory 1 TTPs 10 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/33/maps la.bot.arm6.elf File opened for reading /proc/55/maps la.bot.arm6.elf File opened for reading /proc/66/maps la.bot.arm6.elf File opened for reading /proc/77/maps la.bot.arm6.elf File opened for reading /proc/99/maps la.bot.arm6.elf File opened for reading /proc/111/maps la.bot.arm6.elf File opened for reading /proc/222/maps la.bot.arm6.elf File opened for reading /proc/11/maps la.bot.arm6.elf File opened for reading /proc/22/maps la.bot.arm6.elf File opened for reading /proc/44/maps la.bot.arm6.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself telnetd 657 la.bot.arm6.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp la.bot.arm6.elf -
description ioc Process File opened for reading /proc/2222Z*/fd la.bot.arm6.elf File opened for reading /proc/3333�,/fd la.bot.arm6.elf File opened for reading /proc/4444+/fd la.bot.arm6.elf File opened for reading /proc/66664/fd la.bot.arm6.elf File opened for reading /proc/33/fd la.bot.arm6.elf File opened for reading /proc/1111�"/fd la.bot.arm6.elf File opened for reading /proc/6666t>/fd la.bot.arm6.elf File opened for reading /proc/88ll�"/maps la.bot.arm6.elf File opened for reading /proc/11114/fd la.bot.arm6.elf File opened for reading /proc/2222j,/fd la.bot.arm6.elf File opened for reading /proc/33334/fd la.bot.arm6.elf File opened for reading /proc/66664/fd la.bot.arm6.elf File opened for reading /proc/11114/fd la.bot.arm6.elf File opened for reading /proc/222l�"/fd la.bot.arm6.elf File opened for reading /proc/4444r>/fd la.bot.arm6.elf File opened for reading /proc/6666v>/fd la.bot.arm6.elf File opened for reading /proc/99/fd la.bot.arm6.elf File opened for reading /proc/111�"/fd la.bot.arm6.elf File opened for reading /proc/55/fd la.bot.arm6.elf File opened for reading /proc/888s�"/fd la.bot.arm6.elf File opened for reading /proc/1111�%/fd la.bot.arm6.elf File opened for reading /proc/6666u>/fd la.bot.arm6.elf File opened for reading /proc/111c�"/maps la.bot.arm6.elf File opened for reading /proc/111�"/fd la.bot.arm6.elf File opened for reading /proc/44442/fd la.bot.arm6.elf File opened for reading /proc/66664/fd la.bot.arm6.elf File opened for reading /proc/444/fd la.bot.arm6.elf File opened for reading /proc/44/fd la.bot.arm6.elf File opened for reading /proc/111m�"/fd la.bot.arm6.elf File opened for reading /proc/111c�"/fd la.bot.arm6.elf File opened for reading /proc/1111�(/fd la.bot.arm6.elf File opened for reading /proc/3333q,/fd la.bot.arm6.elf File opened for reading /proc/66664/fd la.bot.arm6.elf File opened for reading /proc/111�"/maps la.bot.arm6.elf File opened for reading /proc/2222�*/fd la.bot.arm6.elf File opened for reading /proc/3333/fd la.bot.arm6.elf File opened for reading /proc/6666�3/fd la.bot.arm6.elf File opened for reading /proc/1111�"/fd la.bot.arm6.elf File opened for reading /proc/222�"/fd la.bot.arm6.elf File opened for reading /proc/11114/fd la.bot.arm6.elf File opened for reading /proc/2222T+/fd la.bot.arm6.elf File opened for reading /proc/6666u3/fd la.bot.arm6.elf File opened for reading /proc/6666�</fd la.bot.arm6.elf File opened for reading /proc/222i�"/fd la.bot.arm6.elf File opened for reading /proc/2222+*/fd la.bot.arm6.elf File opened for reading /proc/3333u./fd la.bot.arm6.elf File opened for reading /proc/6666s>/fd la.bot.arm6.elf File opened for reading /proc/66667/fd la.bot.arm6.elf File opened for reading /proc/111c�"/maps la.bot.arm6.elf File opened for reading /proc/22/fd la.bot.arm6.elf File opened for reading /proc/66/fd la.bot.arm6.elf File opened for reading /proc/77/fd la.bot.arm6.elf File opened for reading /proc/111/fd la.bot.arm6.elf File opened for reading /proc/222/fd la.bot.arm6.elf File opened for reading /proc/222s�"/fd la.bot.arm6.elf File opened for reading /proc/222v�"/fd la.bot.arm6.elf File opened for reading /proc/11/fd la.bot.arm6.elf File opened for reading /proc/1111�"/fd la.bot.arm6.elf File opened for reading /proc/1111�#/fd la.bot.arm6.elf File opened for reading /proc/222�"/fd la.bot.arm6.elf File opened for reading /proc/2222 +/fd la.bot.arm6.elf File opened for reading /proc/444s�"/fd la.bot.arm6.elf File opened for reading /proc/111�"/maps la.bot.arm6.elf File opened for reading /proc/88ll�"/fd la.bot.arm6.elf