Analysis
-
max time kernel
148s -
max time network
150s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
09-01-2025 02:47
Behavioral task
behavioral1
Sample
a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf
Resource
debian9-mipsbe-20240611-en
debian-9-mips
6 signatures
150 seconds
General
-
Target
a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf
-
Size
284KB
-
MD5
2100ce69b057d85fc3eae4d9e1f1fd1b
-
SHA1
0678a71a36a0b1e9673713db060151179256d87f
-
SHA256
a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38
-
SHA512
843d69b3461d3c6d2b4426e230e9863a7351ef83a182f82a0c30e16337b8ed7c92e04ca56cbf90a0fa270433ee7cdec2b0a924d569e9ebcad5eb4f4a92274c21
-
SSDEEP
3072:7BAsIgkocwgzd0GOoUr3Ixla8MBTObtF43WwNIZR6gwpUEMTQllq+l9ydILwcC6X:7YUe1wdmQi3mIPTBJGXbXi+Nx
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for modification /dev/misc/watchdog a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself sshd 719 a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf -
description ioc Process File opened for reading /proc/109/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/720/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/7/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/8/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/22/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/71/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/74/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/717/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/734/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/10/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/21/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/344/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/781/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/754/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/768/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/770/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/777/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/175/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/432/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/711/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/739/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/780/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/750/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/752/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/779/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/756/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/773/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/13/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/378/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/691/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/692/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/767/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/15/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/36/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/753/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/765/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/17/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/125/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/740/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/748/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/391/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/730/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/4/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/716/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/714/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/733/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/775/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/11/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/237/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/345/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/769/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/766/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/254/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/726/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/735/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/749/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/755/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/23/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/392/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/724/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/743/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/2/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/14/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf File opened for reading /proc/19/cmdline a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf
Processes
-
/tmp/a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf/tmp/a7776983dda6f3a62bcdb4ea88d1ec8864a270ff879e61b0b21275715a5d2a38.elf1⤵
- Modifies Watchdog functionality
- Reads system routing table
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:719