Overview

overview

10

Static

static

10

e1245fe782...51.elf

debian-12-mipsel

7

Analysis

  • max time kernel
    64s
  • max time network
    165s
  • platform
    debian-12_mipsel
  • resource
    debian12-mipsel-20240221-en
  • resource tags

    arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
  • submitted
    03-01-2025 01:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e1245fe7825242a19c87b04b3bb3c4d20c8562df664a881508b4268309108251.elf

  • Size

    106KB

  • MD5

    ea32efb911185778be600ecedbe2ddbb

  • SHA1

    8c73f43408256526beba33215be7845798b63910

  • SHA256

    e1245fe7825242a19c87b04b3bb3c4d20c8562df664a881508b4268309108251

  • SHA512

    a12f54044e22298d96310560186e517041a338ba4719a038ec48cc2bbc6ca34166a774534d6cdb5019213528c7016d8df63b650a108d0197692fafcc3638901c

  • SSDEEP

    1536:iAX2gnezXPlAGhpwC4S9P2uI+yXVJZPTnZSu3aCwmj9+:ia2gnezXPllh0lJlTnOE9

Score
7/10
defense_evasiondiscoveryevasionpersistenceprivilege_escalation

Malware Config

Signatures

  • Deletes Audit logs 1 TTPs 1 IoCs

    Deletes logs related to the Linux Audit framework.

    evasion
  • Deletes itself 1 IoCs
  • Deletes journal logs 1 TTPs 1 IoCs

    Deletes systemd journal logs. Likely to evade detection.

    evasion
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Deletes log files 1 TTPs 2 IoCs

    Deletes log files on the system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/e1245fe7825242a19c87b04b3bb3c4d20c8562df664a881508b4268309108251.elf
    /tmp/e1245fe7825242a19c87b04b3bb3c4d20c8562df664a881508b4268309108251.elf
    1⤵
    • Deletes Audit logs
    • Deletes itself
    • Deletes journal logs
    • Modifies Watchdog functionality
    • Deletes log files
    • Modifies systemd
    • Changes its process name
    • Reads runtime system information
    PID:740
    • /bin/sh
      sh -c "systemctl daemon-reload"
      2⤵
        PID:748
        • /usr/bin/systemctl
          systemctl daemon-reload
          3⤵
            PID:750
        • /bin/sh
          sh -c "systemctl enable startup_command.service"
          2⤵
            PID:861
            • /usr/bin/systemctl
              systemctl enable startup_command.service
              3⤵
                PID:864

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /etc/systemd/system/startup_command.service
            Filesize

            361B

            MD5

            4d2c868f454b6c55731485cf0f886dc0

            SHA1

            032b125de0a28dcee8d8d25fbeeb56db7f403f04

            SHA256

            8c4ae1b82477698f3a8c273b439cb9079794afb8fc33cd4def854936ba37ea2c

            SHA512

            060b2413a0cb2dec0db059c190467b5cb0d76209effea4ae3de2701fa71429b811a6f7e11e813b26806cf72578d1f32b608a02a4ce670ec58b5b65433e3cf11d

            Download Submit