Analysis
-
max time kernel
1s -
max time network
3s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
14-12-2024 14:06
Behavioral task
behavioral1
Sample
eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf
Resource
debian9-mipsbe-20240418-en
debian-9-mips
3 signatures
150 seconds
General
-
Target
eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf
-
Size
117KB
-
MD5
21cb220963a78fb1248b54aaa8436ad9
-
SHA1
2b6939f4f160f730894eb46cd30c6dfd43cc5c73
-
SHA256
eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a
-
SHA512
47f9c131aea5eff3803052dbb7c4218b914e0997304c1fc9ab29c3ccad7c1f2e0de175aab6482dfdf23d27733eec7e8563070368656389dddf9fbbe3d0eacc67
-
SSDEEP
1536:c7e+RDMIb5flkDQSbl5jRA/IajbkRSN2ofdC4V/Ie7pVpXBCl61d6/FN:J+aIb5fyj5ajbkRSN2ofxV/5BC4IFN
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for modification /dev/misc/watchdog eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/4/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/110/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/727/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/169/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/329/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/422/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/73/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/119/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/738/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/1/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/21/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/82/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/244/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/745/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/20/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/9/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/11/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/24/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/670/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/355/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/718/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/741/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/744/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/12/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/36/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/77/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/152/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/663/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/721/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/742/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/729/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/730/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/22/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/228/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/704/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/721/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/1/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/328/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/7/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/72/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/81/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/666/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/15/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/70/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/23/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/37/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/75/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/731/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/356/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/359/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/17/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/354/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/737/net/tcp eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/10/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/14/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/663/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/725/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/3/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/5/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/6/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/16/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/18/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/71/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf File opened for reading /proc/74/cmdline eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a.elf