Analysis
-
max time kernel
0s -
max time network
3s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
17-01-2025 04:42
Behavioral task
behavioral1
Sample
4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf
Resource
debian9-mipsbe-20240418-en
debian-9-mips
3 signatures
150 seconds
General
-
Target
4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf
-
Size
104KB
-
MD5
6b0150484e7bb8058c837e361ba0043c
-
SHA1
d1f03e8d2c30478eb705f619559d6bcb4dec0c02
-
SHA256
4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2
-
SHA512
78705e0bfef0f64339d07bdf9544316c89b8a79574fb8d0db6952080231190eca46f1158e6bc9f669f2eacf5ac2bd2504ec0c34b25aa823a4ae6b1fef5ae7d07
-
SSDEEP
1536:IWSIYw56E7E/BO1bR3BjrxS7vEPGEsfrQ4R8eBdml61d6eqsn:SyvE/BO9/jrxS7vEPGEsfc4Rnm4Zqsn
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for modification /dev/misc/watchdog 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/110/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/377/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/699/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/6/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/13/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/14/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/16/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/75/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/704/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/17/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/327/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/668/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/705/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/1/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/15/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/77/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/9/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/698/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/4/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/21/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/22/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/328/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/676/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/23/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/74/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/378/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/73/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/79/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/82/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/671/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/712/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/239/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/360/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/5/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/19/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/675/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/2/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/81/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/147/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/37/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/8/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/10/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/11/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/12/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/18/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/36/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/682/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/703/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/709/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/711/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/20/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/71/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/121/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/122/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/322/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/155/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/170/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/324/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/7/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/24/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/70/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/72/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/76/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf File opened for reading /proc/423/cmdline 4308c69fe16efb544f85ac3106fb307e500070198e6c4f5e8443958c2df993d2.elf