Analysis
-
max time kernel
103s -
max time network
161s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
-
submitted
02-01-2025 02:06
General
-
Target
2b706e649f14f65d18e6c83a2de37568de173cccf071c07a8c6de9f346673c13.elf
-
Size
80KB
-
MD5
8041a12e2093f22364b4576f59baa53a
-
SHA1
2005d320eb32a94e66359a4c614548ccb8841800
-
SHA256
2b706e649f14f65d18e6c83a2de37568de173cccf071c07a8c6de9f346673c13
-
SHA512
e1c8f86aaed766a6750a279f152efa161d35a9fddd4a4dc9f756b7993e367d0813f5df36d5732bbe75fc9b533d91e8c168e6ec7129b8cdf2b82f253b2d6cbb3c
-
SSDEEP
1536:UeQqvm1T9mgitxIdXSYF27hJFhY49+dxRGwa/JeZWbLZprtjYqR5M:UeQ6maUGwaxwOLZppcqRG
Malware Config
Signatures
-
Contacts a large (20209) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 36 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/2b706e649f14f65d18e6c83a2de37568de173cccf071c07a8c6de9f346673c13.elf/tmp/2b706e649f14f65d18e6c83a2de37568de173cccf071c07a8c6de9f346673c13.elf1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information