Analysis
-
max time kernel
150s -
max time network
155s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240729-en -
resource tags
arch:mipselimage:debian12-mipsel-20240729-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
19-12-2024 03:05
Behavioral task
behavioral1
Sample
6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf
Resource
debian12-mipsel-20240729-en
General
-
Target
6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf
-
Size
89KB
-
MD5
e11bac278d87af5c2eb3771a738b92de
-
SHA1
e274cfb910e85ac8b05cb87dc325d92c28de381d
-
SHA256
6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492
-
SHA512
537746dd70e59622dbd68d2a4b80ff84722d980a06373b6ec71987e0715db682f9376b69a644de4e3046ab6f81318373c36ce6c837c7e84063abadafe61a61f3
-
SSDEEP
1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZqci:qCYxrKDy46NZ
Malware Config
Signatures
-
Contacts a large (20671) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for modification /dev/misc/watchdog 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf -
description ioc Process File opened for reading /proc/347/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/380/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/674/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/711/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/717/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/377/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/379/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/392/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/396/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/695/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/698/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/712/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/674/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/698/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/180/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/202/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/675/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/753/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/405/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/745/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/1/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/332/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/692/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/734/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/695/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/408/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/405/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/663/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/732/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/770/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/429/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/714/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/733/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/742/fd 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/692/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/711/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/721/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/408/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/675/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf File opened for reading /proc/731/exe 6f16eacb53d3ec46cac764a5c6ff30cb3b781dd7a21b1c0da0d2004e5f143492.elf