Analysis
-
max time kernel
0s -
max time network
3s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240418-en -
resource tags
arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
17-01-2025 04:55
Behavioral task
behavioral1
Sample
5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
3 signatures
150 seconds
General
-
Target
5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf
-
Size
106KB
-
MD5
0f63f0a1140c72fcda6e8fed05dadbfe
-
SHA1
d3a718f2a790d5cd37c3d5b46fe6899ce9a38651
-
SHA256
5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215
-
SHA512
ff49fceaa5baa4fc1114291cccee87bd0571461a17375109ed6ed5edf3668a66ec93deb432507c91611cbe888158d381f9a20b9dca6af8b4b9d9a8163012cfbd
-
SSDEEP
1536:jyuo5zfiQN84NeR+QMBpx5AJltiwsGZMaKVHM7l61d6Om2flDH:2uQzfiQNT6tcGCQ4Jm+1H
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for modification /dev/misc/watchdog 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/36/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/320/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/371/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/699/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/17/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/21/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/694/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/10/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/82/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/70/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/79/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/702/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/8/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/22/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/75/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/78/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/115/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/159/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/322/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/414/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/11/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/19/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/20/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/3/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/5/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/74/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/167/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/1/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/4/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/319/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/700/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/72/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/73/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/665/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/696/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/18/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/23/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/314/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/71/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/77/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/105/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/231/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/318/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/671/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/6/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/13/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/76/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/9/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/15/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/693/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/149/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/377/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/16/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/24/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/37/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/143/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/668/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/12/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/14/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/116/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/704/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/372/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/698/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf File opened for reading /proc/7/cmdline 5e579eab1ed72088e03bf1a462e9022551d463b42a40f12be45fc4451b5a4215.elf