Analysis
-
max time kernel
24s -
max time network
36s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
03-12-2024 20:32
Behavioral task
behavioral1
Sample
teste.arm
Resource
debian9-armhf-20240611-en
debian-9-armhf
7 signatures
150 seconds
General
-
Target
teste.arm
-
Size
150KB
-
MD5
dc69acabdee7d74b1b3d04a14ace1770
-
SHA1
25a48bbb1582d46300b168830e60327d74266ca7
-
SHA256
cc6d518efad6da404b1ee66d42f4b8734095832ce4cade2c3f410dd51fcc26ef
-
SHA512
6deb6dd560ac3275c997a2b84a0f46d809ca14e62dff16e1f62dc117b811fd4abf32a6c9497e2505d0069929a7f613f286292df29e724a1a0a738d3c86fcadcb
-
SSDEEP
3072:S4ckCtTQc2mNCGOLBFb4UJvVSHpbck03Pdty:S4c3thxCGyzb4U+HRX03Pdo
Score
9/10
Malware Config
Signatures
-
Contacts a large (11770) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog teste.arm File opened for modification /dev/misc/watchdog teste.arm -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog teste.arm File opened for modification /bin/watchdog teste.arm -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M 654 teste.arm -
description ioc Process File opened for reading /proc/659/cmdline teste.arm File opened for reading /proc/681/cmdline teste.arm File opened for reading /proc/716/cmdline teste.arm File opened for reading /proc/300/cmdline teste.arm File opened for reading /proc/647/cmdline teste.arm File opened for reading /proc/653/cmdline teste.arm File opened for reading /proc/8/cmdline teste.arm File opened for reading /proc/11/cmdline teste.arm File opened for reading /proc/41/cmdline teste.arm File opened for reading /proc/277/cmdline teste.arm File opened for reading /proc/409/cmdline teste.arm File opened for reading /proc/667/cmdline teste.arm File opened for reading /proc/679/cmdline teste.arm File opened for reading /proc/9/cmdline teste.arm File opened for reading /proc/141/cmdline teste.arm File opened for reading /proc/724/cmdline teste.arm File opened for reading /proc/10/cmdline teste.arm File opened for reading /proc/451/cmdline teste.arm File opened for reading /proc/664/cmdline teste.arm File opened for reading /proc/668/cmdline teste.arm File opened for reading /proc/23/cmdline teste.arm File opened for reading /proc/696/cmdline teste.arm File opened for reading /proc/714/cmdline teste.arm File opened for reading /proc/715/cmdline teste.arm File opened for reading /proc/6/cmdline teste.arm File opened for reading /proc/106/cmdline teste.arm File opened for reading /proc/107/cmdline teste.arm File opened for reading /proc/131/cmdline teste.arm File opened for reading /proc/649/cmdline teste.arm File opened for reading /proc/725/cmdline teste.arm File opened for reading /proc/20/cmdline teste.arm File opened for reading /proc/607/cmdline teste.arm File opened for reading /proc/699/cmdline teste.arm File opened for reading /proc/706/cmdline teste.arm File opened for reading /proc/711/cmdline teste.arm File opened for reading /proc/19/cmdline teste.arm File opened for reading /proc/290/cmdline teste.arm File opened for reading /proc/693/cmdline teste.arm File opened for reading /proc/24/cmdline teste.arm File opened for reading /proc/684/cmdline teste.arm File opened for reading /proc/694/cmdline teste.arm File opened for reading /proc/723/cmdline teste.arm File opened for reading /proc/7/cmdline teste.arm File opened for reading /proc/264/cmdline teste.arm File opened for reading /proc/651/cmdline teste.arm File opened for reading /proc/657/cmdline teste.arm File opened for reading /proc/705/cmdline teste.arm File opened for reading /proc/709/cmdline teste.arm File opened for reading /proc/717/cmdline teste.arm File opened for reading /proc/13/cmdline teste.arm File opened for reading /proc/5/cmdline teste.arm File opened for reading /proc/16/cmdline teste.arm File opened for reading /proc/18/cmdline teste.arm File opened for reading /proc/27/cmdline teste.arm File opened for reading /proc/147/cmdline teste.arm File opened for reading /proc/718/cmdline teste.arm File opened for reading /proc/2/cmdline teste.arm File opened for reading /proc/42/cmdline teste.arm File opened for reading /proc/707/cmdline teste.arm File opened for reading /proc/719/cmdline teste.arm File opened for reading /proc/22/cmdline teste.arm File opened for reading /proc/646/cmdline teste.arm File opened for reading /proc/689/cmdline teste.arm File opened for reading /proc/695/cmdline teste.arm