b41b5c24eefd09932aec03d62a96fb50a96af20253c998cb52b407121b51950e

Analysis

max time kernel
144s
max time network
147s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
16-01-2025 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pecga.mips.elf
Size

94KB
MD5

9468872fb5f3f65f81ba4856abaddf54
SHA1

2abcd7046fb463a45abe2d7387baf16ee64d704f
SHA256

b41b5c24eefd09932aec03d62a96fb50a96af20253c998cb52b407121b51950e
SHA512

ed14a34bb31f05b91a1a6a4f3470e426683963db80776e73ff589bc45336b029041b74cf05e42779f3d131e9d509a745c1e7d30ca1cad16ce752013adc2eee29
SSDEEP

1536:mF4tsbv54o+3bPhXhW1Jb3QeqfS/SO8Reo6XjLuLe:mF4tsr54o+rPhkP3QeqfS/SO8gXjLge

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
738	pecga.mips.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	pecga.mips.elf
File opened for modification	/dev/misc/watchdog	pecga.mips.elf

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	pecga.mips.elf
File opened for modification	/bin/watchdog	pecga.mips.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	wsu1ek1h5fesqtjf	738	pecga.mips.elf

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
738	pecga.mips.elf

/tmp/pecga.mips.elf
/tmp/pecga.mips.elf
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
- System Network Configuration Discovery
PID:738

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads