Analysis
-
max time kernel
149s -
max time network
154s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240418-en -
resource tags
arch:mipselimage:debian12-mipsel-20240418-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
27-12-2024 02:42
Behavioral task
behavioral1
Sample
742-1-0x00400000-0x0043affc-memory.dmp
Resource
debian12-mipsel-20240418-en
debian-12-mipsel
4 signatures
150 seconds
General
-
Target
742-1-0x00400000-0x0043affc-memory.dmp
-
Size
169KB
-
MD5
9032d52e4ae97dec85e33905b7975d9f
-
SHA1
495c3ed83f0990d6774a92263a61ce32ffef2767
-
SHA256
0069b343769c2ed48f7704e0ad671b961aab35abea46d38add71a33077f56c99
-
SHA512
00fe74968517f26277101cce50a982eace2862331457e73937273d029a010ba721351029f041d1e04a226f2785fc0ad89976119a395bba192933fe3fe4046d44
-
SSDEEP
1536:LIB5U4yVP3ODubf5fsOuQ1VbDrb2acdUgozxkq5sMElq47rN:LujyP3R5fMOAa3zx15AvN
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog 742-1-0x00400000-0x0043affc-memory.dmp File opened for modification /dev/watchdog 742-1-0x00400000-0x0043affc-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 742-1-0x00400000-0x0043affc-memory.dmp File opened for modification /bin/watchdog 742-1-0x00400000-0x0043affc-memory.dmp -
description ioc Process File opened for reading /proc/111/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/353/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/396/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/59/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/34/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/35/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/53/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/739/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/27/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/32/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/45/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/699/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/3/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/23/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/380/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/14/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/15/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/118/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/676/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/10/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/434/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/675/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/713/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/12/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/22/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/693/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/742/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/11/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/112/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/136/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/342/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/720/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/16/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/5/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/113/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/1/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/13/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/18/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/20/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/185/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/413/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/734/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/4/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/7/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/28/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/30/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/33/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/691/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/717/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/2/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/178/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/202/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/711/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/743/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/115/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/31/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/377/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/733/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/9/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/29/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/137/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/391/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/24/status 742-1-0x00400000-0x0043affc-memory.dmp File opened for reading /proc/25/status 742-1-0x00400000-0x0043affc-memory.dmp