Analysis
-
max time kernel
149s -
max time network
141s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
09-01-2025 02:36
Behavioral task
behavioral1
Sample
7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf
Resource
debian9-armhf-20240729-en
General
-
Target
7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf
-
Size
250KB
-
MD5
c75cc798187af6f5a034429a76499d89
-
SHA1
7e77dec1a8b73bad5651a1842498e989142dcf63
-
SHA256
7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f
-
SHA512
dd1beac48fbb0cd9ad27f6e485540da29c4a85d865188abfc83b6d3fff10e1d0df5c24c22593fc563f8450245a0ebbbf49965d53808a1bed6e4ba7c5283faf09
-
SSDEEP
3072:ZbnCy2EkV0X3XzdY4w0Gdf6cCiMTpiXI4jUm2J1lQvggrdP7Nx:WVedlw0OfMT8Am2J1lQvggrdP7Nx
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for modification /dev/misc/watchdog 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself sshd 655 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf -
description ioc Process File opened for reading /proc/6/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/729/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/735/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/744/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/701/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/763/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/146/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/663/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/669/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/686/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/717/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/743/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/22/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/607/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/664/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/713/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/12/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/18/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/21/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/672/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/747/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/25/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/29/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/169/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/641/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/703/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/704/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/715/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/721/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/3/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/28/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/660/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/688/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/764/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/678/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/698/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/714/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/765/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/677/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/706/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/733/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/755/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/324/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/697/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/730/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/731/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/609/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/695/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/705/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/719/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/5/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/42/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/605/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/728/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/708/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/739/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/8/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/19/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/103/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/235/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/762/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/41/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/140/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf File opened for reading /proc/738/cmdline 7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf
Processes
-
/tmp/7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf/tmp/7ef32ab968c070c9a6ecd9d7a5decf05ca8c41b9afd00052ef61406da97ae70f.elf1⤵
- Modifies Watchdog functionality
- Reads system routing table
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:655