e31ef284427ad3585704cdf6b9391263d925da7a8a70b37bee7f3ef26ba3ecbf

Analysis

max time kernel
148s
max time network
147s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29-11-2024 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e31ef284427ad3585704cdf6b9391263d925da7a8a70b37bee7f3ef26ba3ecbf.elf
Size

122KB
MD5

db0b5bb554e59079c6181013bc71a1f1
SHA1

ef39dcd4a75d253b9e998b85c052f85a51a243a5
SHA256

e31ef284427ad3585704cdf6b9391263d925da7a8a70b37bee7f3ef26ba3ecbf
SHA512

62a1d85b9a32c4ec81df956487ac10fc023291871ed244458b150c66bf2a1a49c3e06cbf2de5c0448080722d8c64d3d2d7924bdfb20b4b206da8798a1e1bc868
SSDEEP

3072:4jDy/+mh1vtbPIKaDbpcUPium7/L7QsvmGfIiNb:mOJ1vxfaDbywm7/L7QsvmGfIiNb

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	e31ef284427ad3585704cdf6b9391263d925da7a8a70b37bee7f3ef26ba3ecbf.elf
File opened for modification	/dev/watchdog	e31ef284427ad3585704cdf6b9391263d925da7a8a70b37bee7f3ef26ba3ecbf.elf

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	e31ef284427ad3585704cdf6b9391263d925da7a8a70b37bee7f3ef26ba3ecbf.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	sshd	663	e31ef284427ad3585704cdf6b9391263d925da7a8a70b37bee7f3ef26ba3ecbf.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	e31ef284427ad3585704cdf6b9391263d925da7a8a70b37bee7f3ef26ba3ecbf.elf

/tmp/e31ef284427ad3585704cdf6b9391263d925da7a8a70b37bee7f3ef26ba3ecbf.elf
/tmp/e31ef284427ad3585704cdf6b9391263d925da7a8a70b37bee7f3ef26ba3ecbf.elf
1⤵
- Modifies Watchdog functionality
- Reads system routing table
- Changes its process name
- Reads system network configuration
PID:663

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads