Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20240221-en
  • resource tags

    arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    05-12-2024 01:13

General

  • Target

    4552c115a47e1882ec87f4a4d0319763201cce7876b916d55332928b552bc1ad.elf

  • Size

    199KB

  • MD5

    3e03e6c5c24e3d7af651744dc5b6b88a

  • SHA1

    3b72156fb6f8245af090c089be01fcb6c42fc110

  • SHA256

    4552c115a47e1882ec87f4a4d0319763201cce7876b916d55332928b552bc1ad

  • SHA512

    5887f5f5f394b7ee8a03cee473e2e660c25fabf901deba34d62441fed228e06f70f998ddb24ebd4133795ab542c4c6a3a67063a68f96d016655c836bd17b7a16

  • SSDEEP

    6144:Q43n3ziAve1ABavXksxMbcVYY/KxtM/R+77oJxA:Q433zw1ABavXksxMFNxW/fJG

Malware Config

Signatures

  • Contacts a large (71661) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 2 IoCs
  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/4552c115a47e1882ec87f4a4d0319763201cce7876b916d55332928b552bc1ad.elf
    /tmp/4552c115a47e1882ec87f4a4d0319763201cce7876b916d55332928b552bc1ad.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Changes its process name
    • Reads runtime system information
    PID:708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads