Analysis
-
max time kernel
67s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
23-12-2024 16:06
Behavioral task
behavioral1
Sample
22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd
Resource
debian9-armhf-20240611-en
General
-
Target
22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd
-
Size
117KB
-
MD5
1ffc6391cbd14941a6bbf63e99574ba3
-
SHA1
e0d0ed3bbd07ac82c62b36c90e98306f7e666f16
-
SHA256
22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd
-
SHA512
43e739848da6df1d94c7b3fdeb5cf9fe6bbdea5c5acc58c02f875ce1fe6a7dce0615bdd29c72cce2e07067629b69ab84a38def50c96928e4a96f6401d0f35eda
-
SSDEEP
3072:FQXIXLM947iz8QDvxdEOm/oic4s0au37mM/9HM:eXIY947iYAvxdEOmAio0auCM/9HM
Malware Config
Signatures
-
Contacts a large (227902) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for modification /dev/misc/watchdog 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /var/Sofia 661 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd -
description ioc Process File opened for reading /proc/816/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/780/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/801/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/784/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/802/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/690/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/770/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/748/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/791/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/709/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/738/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/740/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/764/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/803/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/810/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/813/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/653/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/739/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/658/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/660/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/800/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/806/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/808/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/508/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/616/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/761/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/804/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/705/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/706/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/809/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/465/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/770/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/733/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/777/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/353/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/690/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/748/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/787/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/353/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/728/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/728/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/733/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/737/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/616/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/691/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/706/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/779/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/508/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/672/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/737/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/763/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/791/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/792/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/797/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/812/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/509/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/738/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/696/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/701/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/739/exe 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/796/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/301/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/660/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd File opened for reading /proc/764/cmdline 22c8f459658d7a9bc41ad39c5491d6013e68a0fd95b6b9d28ccfb84754eabadd