Analysis
-
max time kernel
149s -
max time network
7s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
26-12-2024 16:59
Behavioral task
behavioral1
Sample
717-1-0x00400000-0x0042ce64-memory.dmp
Resource
debian9-mipsbe-20240611-en
debian-9-mips
3 signatures
150 seconds
General
-
Target
717-1-0x00400000-0x0042ce64-memory.dmp
-
Size
113KB
-
MD5
bd0d08d03aa4b546359f06a2a466a226
-
SHA1
f062cd9d7ae886a22facfc1468f343fab0b22883
-
SHA256
395c069f3261763bb3b84b05dfdff88707337d9d56a8170e3487c5b5eec10545
-
SHA512
e4d890f12ec986d3bf7ebeb3104600ec43e5aed04a3387f9e1b615d2ee6e87ef4bdf73ac8eb36b174b2e46896c1489222ae00f1579e0bca3b43117eb70a2e688
-
SSDEEP
3072:OrCjaLg3IbSU07blgrUPu/NRDVFR7VmcFRUFb1lKWxa:OrCjas3ImU07blgrUO2Fb1lKWxa
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 717-1-0x00400000-0x0042ce64-memory.dmp File opened for modification /dev/misc/watchdog 717-1-0x00400000-0x0042ce64-memory.dmp -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 717-1-0x00400000-0x0042ce64-memory.dmp File opened for modification /bin/watchdog 717-1-0x00400000-0x0042ce64-memory.dmp -
description ioc Process File opened for reading /proc/766/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/781/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/803/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/669/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/676/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/705/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/714/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/736/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/432/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/740/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/752/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/741/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/773/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/791/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/687/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/700/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/706/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/707/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/712/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/769/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/674/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/677/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/701/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/718/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp File opened for reading /proc/753/cmdline 717-1-0x00400000-0x0042ce64-memory.dmp