Analysis
-
max time kernel
145s -
max time network
155s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
09-01-2025 02:11
Behavioral task
behavioral1
Sample
2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
6 signatures
150 seconds
General
-
Target
2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf
-
Size
259KB
-
MD5
f5766e54f5df87a84bb3cb507140f983
-
SHA1
92809fb7294d6e15a4ed75af713c34209a78c289
-
SHA256
2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5
-
SHA512
ad77af96f0ddca58db25e49d7e025c6cff7964742ca261c9096fe46957b97295a4d9303780c883dc704f4d1df11963de9a4f2f542ce96bc5972112b24f639900
-
SSDEEP
6144:MargtN+467jhcaVogahXGAm20Q7tJPjNS:MJN165cayFIAm20ItJPjNS
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for modification /dev/misc/watchdog 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/sbin/dropbear 712 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf -
description ioc Process File opened for reading /proc/718/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/745/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/918/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/3/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/714/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/820/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/17/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/45/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/775/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/880/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/675/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/770/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/807/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/822/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/787/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/791/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/796/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/851/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/11/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/143/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/768/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/771/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/852/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/933/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/942/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/738/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/833/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/769/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/873/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/948/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/949/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/862/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/905/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/935/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/736/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/760/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/809/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/841/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/18/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/754/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/767/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/816/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/900/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/945/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/947/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/837/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/854/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/922/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/923/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/2/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/32/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/42/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/739/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/944/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/256/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/868/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/885/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/892/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/853/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/903/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/930/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/344/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/627/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf File opened for reading /proc/776/cmdline 2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf
Processes
-
/tmp/2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf/tmp/2941cbc75ad488a27b993dbd439e21b0ee6335cc95872559f46c56aadf4c7bc5.elf1⤵
- Modifies Watchdog functionality
- Reads system routing table
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:712