490567abfb0d2b7426dee90132ed02a7a6d12bfbb7485fcd49becc6cf5e37c4a

Analysis

max time kernel
29s
max time network
30s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
31/12/2024, 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mips.elf
Size

104KB
MD5

672a92c650fc5fc17b196f0cd4609b4c
SHA1

1d60572c83ed8e7314886fec57ff675e4cb4aa3b
SHA256

490567abfb0d2b7426dee90132ed02a7a6d12bfbb7485fcd49becc6cf5e37c4a
SHA512

6f33a9c16f4f4ca817b69f7b28756f2e51ff18050cf2b748472a9a540377d329cff3494f51027997a8a0bafb8f64224562b0c7b0dfe7008e541c938a4cac301b
SSDEEP

1536:krux+7NqaAoyhvrRLHXUz/1c7SM7yHNIz1D5OjysrIreFvqvdNrf:Nx+7gaAokT1Ez/1y+q5D5OjrrIOCvdND

Score

7^/10

defense_evasion discovery evasion persistence privilege_escalation

Malware Config

Signatures

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/audit/audit.log	mips.elf

Deletes itself 1 IoCs

pid	Process
713	mips.elf

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	mips.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	mips.elf
File opened for modification	/dev/misc/watchdog	mips.elf

Deletes log files 1 TTPs 3 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/wtmp	mips.elf
File deleted	/var/log/daemon.log	mips.elf
File deleted	/var/log/auth.log	mips.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/startup_command.service	mips.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	nkhvvlclwphesg5l6wed	713	mips.elf

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/19/cmdline	mips.elf
File opened for reading	/proc/71/cmdline	mips.elf
File opened for reading	/proc/73/cmdline	mips.elf
File opened for reading	/proc/671/cmdline	mips.elf
File opened for reading	/proc/674/cmdline	mips.elf
File opened for reading	/proc/7/cmdline	mips.elf
File opened for reading	/proc/23/cmdline	mips.elf
File opened for reading	/proc/114/cmdline	mips.elf
File opened for reading	/proc/147/cmdline	mips.elf
File opened for reading	/proc/826/cmdline	mips.elf
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/21/cmdline	mips.elf
File opened for reading	/proc/37/cmdline	mips.elf
File opened for reading	/proc/67/cmdline	mips.elf
File opened for reading	/proc/329/cmdline	mips.elf
File opened for reading	/proc/379/cmdline	mips.elf
File opened for reading	/proc/692/cmdline	mips.elf
File opened for reading	/proc/711/cmdline	mips.elf
File opened for reading	/proc/6/cmdline	mips.elf
File opened for reading	/proc/821/cmdline	mips.elf
File opened for reading	/proc/12/cmdline	mips.elf
File opened for reading	/proc/14/cmdline	mips.elf
File opened for reading	/proc/18/cmdline	mips.elf
File opened for reading	/proc/72/cmdline	mips.elf
File opened for reading	/proc/115/cmdline	mips.elf
File opened for reading	/proc/141/cmdline	mips.elf
File opened for reading	/proc/759/cmdline	mips.elf
File opened for reading	/proc/5/cmdline	mips.elf
File opened for reading	/proc/825/cmdline	mips.elf
File opened for reading	/proc/10/cmdline	mips.elf
File opened for reading	/proc/20/cmdline	mips.elf
File opened for reading	/proc/77/cmdline	mips.elf
File opened for reading	/proc/355/cmdline	mips.elf
File opened for reading	/proc/4/cmdline	mips.elf
File opened for reading	/proc/13/cmdline	mips.elf
File opened for reading	/proc/11/cmdline	mips.elf
File opened for reading	/proc/104/cmdline	mips.elf
File opened for reading	/proc/328/cmdline	mips.elf
File opened for reading	/proc/330/cmdline	mips.elf
File opened for reading	/proc/683/cmdline	mips.elf
File opened for reading	/proc/713/cmdline	mips.elf
File opened for reading	/proc/9/cmdline	mips.elf
File opened for reading	/proc/816/cmdline	mips.elf
File opened for reading	/proc/439/cmdline	mips.elf
File opened for reading	/proc/3/cmdline	mips.elf
File opened for reading	/proc/378/cmdline	mips.elf
File opened for reading	/proc/710/cmdline	mips.elf
File opened for reading	/proc/819/cmdline	mips.elf
File opened for reading	/proc/17/cmdline	mips.elf
File opened for reading	/proc/16/cmdline	mips.elf
File opened for reading	/proc/24/cmdline	mips.elf
File opened for reading	/proc/36/cmdline	mips.elf
File opened for reading	/proc/75/cmdline	mips.elf
File opened for reading	/proc/712/cmdline	mips.elf
File opened for reading	/proc/722/cmdline	mips.elf
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/2/cmdline	mips.elf
File opened for reading	/proc/66/cmdline	mips.elf
File opened for reading	/proc/76/cmdline	mips.elf
File opened for reading	/proc/81/cmdline	mips.elf
File opened for reading	/proc/165/cmdline	mips.elf
File opened for reading	/proc/239/cmdline	mips.elf
File opened for reading	/proc/22/cmdline	mips.elf
File opened for reading	/proc/325/cmdline	mips.elf

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
713	mips.elf

/tmp/mips.elf
/tmp/mips.elf
1⤵
- Deletes Audit logs
- Deletes itself
- Deletes system logs
- Modifies Watchdog functionality
- Deletes log files
- Modifies systemd
- Changes its process name
- Reads runtime system information
- System Network Configuration Discovery
PID:713
- /bin/sh
  sh -c "for pid in \$(ls /proc | grep -E '^[0-9]+\$'); do grep -q '(deleted)' /proc/\$pid/maps && kill -9 \$pid || true; done;"
  2⤵
  PID:714
- - /bin/ls
    ls /proc
    3⤵
    - Reads runtime system information
    PID:717
- - /bin/grep
    grep -E "^[0-9]+\$"
    3⤵
    PID:718
- - /bin/grep
    grep -q "(deleted)" /proc/1/maps
    3⤵
    PID:720
- - /bin/grep
    grep -q "(deleted)" /proc/10/maps
    3⤵
    PID:723
- - /bin/grep
    grep -q "(deleted)" /proc/104/maps
    3⤵
    PID:728
- - /bin/grep
    grep -q "(deleted)" /proc/11/maps
    3⤵
    PID:730
- - /bin/grep
    grep -q "(deleted)" /proc/114/maps
    3⤵
    PID:733
- - /bin/grep
    grep -q "(deleted)" /proc/115/maps
    3⤵
    PID:735
- - /bin/grep
    grep -q "(deleted)" /proc/12/maps
    3⤵
    PID:738
- - /bin/grep
    grep -q "(deleted)" /proc/13/maps
    3⤵
    PID:741
- - /bin/grep
    grep -q "(deleted)" /proc/14/maps
    3⤵
    PID:743
- - /bin/grep
    grep -q "(deleted)" /proc/141/maps
    3⤵
    PID:745
- - /bin/grep
    grep -q "(deleted)" /proc/147/maps
    3⤵
    PID:747
- - /bin/grep
    grep -q "(deleted)" /proc/15/maps
    3⤵
    PID:748
- - /bin/grep
    grep -q "(deleted)" /proc/150/maps
    3⤵
    PID:750
- - /bin/grep
    grep -q "(deleted)" /proc/16/maps
    3⤵
    PID:752
- - /bin/grep
    grep -q "(deleted)" /proc/165/maps
    3⤵
    PID:753
- - /bin/grep
    grep -q "(deleted)" /proc/17/maps
    3⤵
    PID:754
- - /bin/grep
    grep -q "(deleted)" /proc/18/maps
    3⤵
    PID:756
- - /bin/grep
    grep -q "(deleted)" /proc/19/maps
    3⤵
    PID:758
- - /bin/grep
    grep -q "(deleted)" /proc/2/maps
    3⤵
    PID:760
- - /bin/grep
    grep -q "(deleted)" /proc/20/maps
    3⤵
    PID:761
- - /bin/grep
    grep -q "(deleted)" /proc/21/maps
    3⤵
    PID:763
- - /bin/grep
    grep -q "(deleted)" /proc/22/maps
    3⤵
    PID:764
- - /bin/grep
    grep -q "(deleted)" /proc/227/maps
    3⤵
    PID:765
- - /bin/grep
    grep -q "(deleted)" /proc/23/maps
    3⤵
    PID:766
- - /bin/grep
    grep -q "(deleted)" /proc/239/maps
    3⤵
    PID:767
- - /bin/grep
    grep -q "(deleted)" /proc/24/maps
    3⤵
    PID:769
- - /bin/grep
    grep -q "(deleted)" /proc/3/maps
    3⤵
    PID:770
- - /bin/grep
    grep -q "(deleted)" /proc/325/maps
    3⤵
    PID:771
- - /bin/grep
    grep -q "(deleted)" /proc/328/maps
    3⤵
    PID:772
- - /bin/grep
    grep -q "(deleted)" /proc/329/maps
    3⤵
    PID:773
- - /bin/grep
    grep -q "(deleted)" /proc/330/maps
    3⤵
    PID:774
- - /bin/grep
    grep -q "(deleted)" /proc/355/maps
    3⤵
    PID:775
- - /bin/grep
    grep -q "(deleted)" /proc/36/maps
    3⤵
    PID:776
- - /bin/grep
    grep -q "(deleted)" /proc/37/maps
    3⤵
    PID:777
- - /bin/grep
    grep -q "(deleted)" /proc/378/maps
    3⤵
    PID:778
- - /bin/grep
    grep -q "(deleted)" /proc/379/maps
    3⤵
    PID:779
- - /bin/grep
    grep -q "(deleted)" /proc/386/maps
    3⤵
    PID:780
- - /bin/grep
    grep -q "(deleted)" /proc/4/maps
    3⤵
    PID:781
- - /bin/grep
    grep -q "(deleted)" /proc/439/maps
    3⤵
    PID:782
- - /bin/grep
    grep -q "(deleted)" /proc/5/maps
    3⤵
    PID:783
- - /bin/grep
    grep -q "(deleted)" /proc/6/maps
    3⤵
    PID:784
- - /bin/grep
    grep -q "(deleted)" /proc/66/maps
    3⤵
    PID:785
- - /bin/grep
    grep -q "(deleted)" /proc/67/maps
    3⤵
    PID:786
- - /bin/grep
    grep -q "(deleted)" /proc/671/maps
    3⤵
    PID:787
- - /bin/grep
    grep -q "(deleted)" /proc/674/maps
    3⤵
    PID:788
- - /bin/grep
    grep -q "(deleted)" /proc/683/maps
    3⤵
    PID:789
- - /bin/grep
    grep -q "(deleted)" /proc/691/maps
    3⤵
    PID:790
- - /bin/grep
    grep -q "(deleted)" /proc/692/maps
    3⤵
    PID:791
- - /bin/grep
    grep -q "(deleted)" /proc/693/maps
    3⤵
    PID:792
- - /bin/grep
    grep -q "(deleted)" /proc/7/maps
    3⤵
    PID:793
- - /bin/grep
    grep -q "(deleted)" /proc/705/maps
    3⤵
    PID:794
- - /bin/grep
    grep -q "(deleted)" /proc/706/maps
    3⤵
    PID:795
- - /bin/grep
    grep -q "(deleted)" /proc/708/maps
    3⤵
    PID:796
- - /bin/grep
    grep -q "(deleted)" /proc/71/maps
    3⤵
    PID:797
- - /bin/grep
    grep -q "(deleted)" /proc/710/maps
    3⤵
    PID:798
- - /bin/grep
    grep -q "(deleted)" /proc/711/maps
    3⤵
    PID:799
- - /bin/grep
    grep -q "(deleted)" /proc/712/maps
    3⤵
    PID:800
- - /bin/grep
    grep -q "(deleted)" /proc/713/maps
    3⤵
    PID:801
- - /bin/grep
    grep -q "(deleted)" /proc/714/maps
    3⤵
    PID:802
- - /bin/grep
    grep -q "(deleted)" /proc/716/maps
    3⤵
    PID:803
- - /bin/grep
    grep -q "(deleted)" /proc/717/maps
    3⤵
    PID:804
- - /bin/grep
    grep -q "(deleted)" /proc/718/maps
    3⤵
    PID:805
- - /bin/grep
    grep -q "(deleted)" /proc/72/maps
    3⤵
    PID:806
- - /bin/grep
    grep -q "(deleted)" /proc/73/maps
    3⤵
    PID:807
- - /bin/grep
    grep -q "(deleted)" /proc/74/maps
    3⤵
    PID:808
- - /bin/grep
    grep -q "(deleted)" /proc/75/maps
    3⤵
    PID:809
- - /bin/grep
    grep -q "(deleted)" /proc/76/maps
    3⤵
    PID:810
- - /bin/grep
    grep -q "(deleted)" /proc/77/maps
    3⤵
    PID:811
- - /bin/grep
    grep -q "(deleted)" /proc/8/maps
    3⤵
    PID:812
- - /bin/grep
    grep -q "(deleted)" /proc/81/maps
    3⤵
    PID:813
- - /bin/grep
    grep -q "(deleted)" /proc/9/maps
    3⤵
    PID:814
- /bin/sh
  sh -c "systemctl daemon-reload"
  2⤵
  PID:818
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/systemd/system/startup_command.service

Filesize
361B

MD5
4d2c868f454b6c55731485cf0f886dc0

SHA1
032b125de0a28dcee8d8d25fbeeb56db7f403f04

SHA256
8c4ae1b82477698f3a8c273b439cb9079794afb8fc33cd4def854936ba37ea2c

SHA512
060b2413a0cb2dec0db059c190467b5cb0d76209effea4ae3de2701fa71429b811a6f7e11e813b26806cf72578d1f32b608a02a4ce670ec58b5b65433e3cf11d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads