Analysis
-
max time kernel
101s -
max time network
165s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
24-12-2024 01:38
Behavioral task
behavioral1
Sample
67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf
Resource
debian12-mipsel-20240221-en
General
-
Target
67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf
-
Size
89KB
-
MD5
9a397c973a66d7380ca64d61070b88d3
-
SHA1
f6828d001883357d22adf948b087ca400c5498dc
-
SHA256
67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc
-
SHA512
18c4d902787043acdc63b3640f6e405dc8f96be38fbd40664595b1c6224adddcfc7895a20417a0de140c8280dc117f3dc7e9bcbb9336b8f0eabfb9f44d7adb77
-
SSDEEP
1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZqCi:qCYxrKDy46Nr
Malware Config
Signatures
-
Contacts a large (12720) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for modification /dev/misc/watchdog 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf -
description ioc Process File opened for reading /proc/420/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/711/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/746/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/794/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/713/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/721/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/730/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/1/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/385/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/696/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/410/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/541/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/796/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/542/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/710/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/717/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/329/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/383/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/396/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/400/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/683/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/781/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/711/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/752/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/774/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/783/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/409/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/710/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/713/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/744/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/718/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/791/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/343/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/409/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/686/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/696/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/795/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/792/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/686/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/740/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/742/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/744/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/683/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/542/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/729/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/812/exe 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/179/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/202/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/381/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/410/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf File opened for reading /proc/541/fd 67b7d4c356522d870024d4f04289dc6bcc53537209478fe43347511abb7e63fc.elf