Analysis

  • max time kernel
    121s
  • max time network
    155s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240611-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    05-12-2024 01:57

General

  • Target

    3010da171a6907ee997460ba49c59b50285b1a9e7acca93759d51f81bf6ff01f.elf

  • Size

    87KB

  • MD5

    ef8daf11e4d7f6e5ceb5231e5333b9a7

  • SHA1

    3cb74d506ffaca5a3d2b865a41ba8c4a1943ebda

  • SHA256

    3010da171a6907ee997460ba49c59b50285b1a9e7acca93759d51f81bf6ff01f

  • SHA512

    6091a8a7f6c6f457cf0328e0d3a160eb2f867f6674598bc3afe682928f1e82e81bb307e771331feb808c465bd349690cd013e4ae8a0a8246b81354665c60cf6b

  • SSDEEP

    1536:sC5FAh5hytl3jWNU8mr6RdmZozXKzVuMFhFSwACVElNNEEH4uIj:xrAh2tl3jQU8mrImZozXGdACVElN6EYD

Malware Config

Signatures

  • Contacts a large (143281) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder 2 IoCs
  • Changes its process name 1 IoCs

Processes

  • /tmp/3010da171a6907ee997460ba49c59b50285b1a9e7acca93759d51f81bf6ff01f.elf
    /tmp/3010da171a6907ee997460ba49c59b50285b1a9e7acca93759d51f81bf6ff01f.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Changes its process name
    PID:704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads