Overview

overview

10

Static

static

10

fil.bin

debian-9-armhf

9

Resubmissions

07-12-2024 14:43

241207-r3v6wsvqaw 10

07-12-2024 14:36

241207-ry31yazrar 10

Analysis

  • max time kernel
    209s
  • max time network
    213s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    07-12-2024 14:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fil.bin

  • Size

    199KB

  • MD5

    3e03e6c5c24e3d7af651744dc5b6b88a

  • SHA1

    3b72156fb6f8245af090c089be01fcb6c42fc110

  • SHA256

    4552c115a47e1882ec87f4a4d0319763201cce7876b916d55332928b552bc1ad

  • SHA512

    5887f5f5f394b7ee8a03cee473e2e660c25fabf901deba34d62441fed228e06f70f998ddb24ebd4133795ab542c4c6a3a67063a68f96d016655c836bd17b7a16

  • SSDEEP

    6144:Q43n3ziAve1ABavXksxMbcVYY/KxtM/R+77oJxA:Q433zw1ABavXksxMFNxW/fJG

Score
9/10
defense_evasiondiscovery

Malware Config

Signatures

  • Contacts a large (103895) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 2 IoCs
  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/fil.bin
    /tmp/fil.bin
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Changes its process name
    • Reads runtime system information
    PID:653

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads