Analysis
-
max time kernel
150s -
max time network
162s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
19-12-2024 04:35
Behavioral task
behavioral1
Sample
fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf
Resource
debian12-armhf-20240221-en
General
-
Target
fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf
-
Size
152KB
-
MD5
9cd4922472ca9d4c51932f13166e335e
-
SHA1
c582c682f2f6f70e0101bfe6e2287d42a0599082
-
SHA256
fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1
-
SHA512
73ce8947b7a777d1b1f10d47b7575d4890d7ddfbd259cdf3fd785d778cdfe2e1d89c284742cbd1acd499a982f9ef1d5e9588e99cd8be42f495a2a517d4550072
-
SSDEEP
3072:ye9bqia5r9J5o9yhpZPH+9mrsplDKZU2QBKXAVanxX+F8JyvIT+hLBA4emlEBDzc:ye9bqia5r97o9yhpZv+9mrsplDKZU2QB
Malware Config
Signatures
-
Contacts a large (20320) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for modification /dev/misc/watchdog fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf -
description ioc Process File opened for reading /proc/334/fd fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/712/exe fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/221/fd fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/633/exe fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/648/exe fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/665/exe fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/336/fd fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/339/fd fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/1/fd fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/188/fd fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/244/fd fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/355/fd fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/649/exe fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/707/exe fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/343/fd fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/664/exe fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/315/fd fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/321/fd fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/715/exe fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/630/exe fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/679/exe fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/720/exe fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/745/exe fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/317/fd fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/328/fd fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/700/exe fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf File opened for reading /proc/706/exe fea0959d65ea7100e7ce7b536138fa11bb44754b167a4377a2b117da70e422b1.elf