Analysis
-
max time kernel
0s -
max time network
3s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240729-en -
resource tags
arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
14-12-2024 02:06
Behavioral task
behavioral1
Sample
07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
3 signatures
150 seconds
General
-
Target
07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf
-
Size
118KB
-
MD5
034bae419c844c89b42d2b39200d15ca
-
SHA1
3cfaf658fc0bf57fd431c430693cff7a342781bc
-
SHA256
07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983
-
SHA512
a08cc0ec6b0012dd5b816b0ea12773b289a80ed8322751c855d71b9aa397f8193c0db3f1b193e92f1ac80b23a6dc02ddbfa9d730cb220e23fa54534653ab0083
-
SSDEEP
1536:BGmnLpEKrHc9o8uGC9KF86e//F7ogl/f4ZLpL35FstAPeemQSl61d6vZgum:RLuKrHc3Cd5ln4vRaQS44Zg
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for modification /dev/watchdog 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/723/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/725/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/680/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/733/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/2/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/5/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/6/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/15/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/20/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/243/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/729/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/10/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/74/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/75/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/79/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/715/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/334/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/732/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/7/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/71/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/332/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/383/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/707/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/730/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/731/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/37/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/77/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/233/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/706/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/434/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/722/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/24/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/81/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/434/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/719/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/386/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/4/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/383/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/678/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/707/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/711/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/330/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/333/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/721/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/3/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/16/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/36/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/76/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/120/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/674/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/681/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/712/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/156/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/728/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/17/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/72/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/362/net/tcp 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/8/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/23/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/67/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/160/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/386/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/709/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf File opened for reading /proc/1/cmdline 07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983.elf