a704d980037d64a963b8790adef0f7f108cbf5140411dffdc42264c3c4e0b07e

Analysis

max time kernel
126s
max time network
164s
platform
debian-12_mipsel
resource
debian12-mipsel-20240221-en
resource tags

arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
08/12/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

meerkat.mpsl.elf
Size

94KB
MD5

7e1f70f848cdb5da083b60a9ddd162e6
SHA1

19ae1e208fcdc6a48c18a196ad0a74b16cddc8de
SHA256

a704d980037d64a963b8790adef0f7f108cbf5140411dffdc42264c3c4e0b07e
SHA512

d355621f2bfbadd69011a04a73d76454b5d1410b6534e4192f53f2e464b8f11228b139741cfccdbeda1ff5a8ddf44eb3883b2c01c28b9c34ab0ef5dffdc1f07e
SSDEEP

768:BnJDTFOU1Q0HeByl6SR9KhE3jU1t7zDh5YUeYOezgeR9GAlNYwN36gT3OXilYraP:lPOU1Q0UY3ADhV1OygS9hNVhrka7g0X

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (17429) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	meerkat.mpsl.elf
File opened for modification	/dev/watchdog	meerkat.mpsl.elf

Reads runtime system information 26 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/742/smaps	meerkat.mpsl.elf
File opened for reading	/proc/747/smaps	meerkat.mpsl.elf
File opened for reading	/proc/411/smaps	meerkat.mpsl.elf
File opened for reading	/proc/421/smaps	meerkat.mpsl.elf
File opened for reading	/proc/692/smaps	meerkat.mpsl.elf
File opened for reading	/proc/711/smaps	meerkat.mpsl.elf
File opened for reading	/proc/404/smaps	meerkat.mpsl.elf
File opened for reading	/proc/630/smaps	meerkat.mpsl.elf
File opened for reading	/proc/800/smaps	meerkat.mpsl.elf
File opened for reading	/proc/774/smaps	meerkat.mpsl.elf
File opened for reading	/proc/816/smaps	meerkat.mpsl.elf
File opened for reading	/proc/631/smaps	meerkat.mpsl.elf
File opened for reading	/proc/635/smaps	meerkat.mpsl.elf
File opened for reading	/proc/730/smaps	meerkat.mpsl.elf
File opened for reading	/proc/773/smaps	meerkat.mpsl.elf
File opened for reading	/proc/714/smaps	meerkat.mpsl.elf
File opened for reading	/proc/717/smaps	meerkat.mpsl.elf
File opened for reading	/proc/720/smaps	meerkat.mpsl.elf
File opened for reading	/proc/731/smaps	meerkat.mpsl.elf
File opened for reading	/proc/407/smaps	meerkat.mpsl.elf
File opened for reading	/proc/410/smaps	meerkat.mpsl.elf
File opened for reading	/proc/690/smaps	meerkat.mpsl.elf
File opened for reading	/proc/694/smaps	meerkat.mpsl.elf
File opened for reading	/proc/741/smaps	meerkat.mpsl.elf
File opened for reading	/proc/772/smaps	meerkat.mpsl.elf
File opened for reading	/proc/796/smaps	meerkat.mpsl.elf

/tmp/meerkat.mpsl.elf
/tmp/meerkat.mpsl.elf
1⤵
- Modifies Watchdog functionality
- Reads runtime system information
PID:738

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads