228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3

Analysis

max time kernel
149s
max time network
162s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/12/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
Size

74KB
MD5

6f385e34a529a813db4e20750b6c14af
SHA1

651d7fc6b969f4e4a9e678f1168f87a287a208ac
SHA256

228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3
SHA512

34e1475cb475e7e548489a4e430c9bc39c6db3c7264199d1bb9bba46be3e2023443fdd6efb94ab914b271ef596ee551a170f309b9848b6104b96d2431b8a2c9f
SSDEEP

1536:usO1+BkQ8yi6dT9ncsnxLs9ewNJ4LtGKu/NsAqXLHeiNODui9VAU1vu:usO1akQLk/yz7+iNi/pu

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (22867) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for modification	/dev/watchdog	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 32 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/664/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/669/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/775/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/792/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/794/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/413/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/662/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/663/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/803/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/676/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/784/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/426/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/657/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/668/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/463/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/716/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/658/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/796/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/788/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/790/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/802/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/698/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/717/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/780/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/672/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/782/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/800/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/618/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/793/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/464/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/786/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
File opened for reading	/proc/798/smaps	228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf

/tmp/228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
/tmp/228b648ba3082c01436d3a993ab3f486815853704cb09518f3ffed92deaec9b3.elf
1⤵
- Modifies Watchdog functionality
- Reads runtime system information
PID:665

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads