Overview

overview

10

Static

static

10

2a2c7b507a...03.elf

debian-12-armhf

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2a2c7b507aad6d5693224073ecc6770676c51f9ce89faaf3938f17a6f6357803.elf

  • Size

    146KB

  • Sample

    250202-epqb9swncm

  • MD5

    a212645280e17498d7976ae220f9b773

  • SHA1

    6ae06870f573a230dfceba5e5932e90369048f60

  • SHA256

    2a2c7b507aad6d5693224073ecc6770676c51f9ce89faaf3938f17a6f6357803

  • SHA512

    491fc661ca900f8f5084f47292a8f14c2b1d59f5f612287de414b191c173e4793f8a9b2e6a9d7a6ee0077ce54dad8bf6e352642f90c3b84f30254988958e7fad

  • SSDEEP

    3072:xcpEtHu5X8Qb8OVdO21MlFUPcOGHw+22YDCBNP8kyXaJ61M/9Vnr:xiEtHu58Qb8Yb9GHw+2jDqNuXaJQM/9F

Score
10/10
miraicredential_accessdefense_evasiondiscovery

Malware Config

Targets

    • Target

      2a2c7b507aad6d5693224073ecc6770676c51f9ce89faaf3938f17a6f6357803.elf

    • Size

      146KB

    • MD5

      a212645280e17498d7976ae220f9b773

    • SHA1

      6ae06870f573a230dfceba5e5932e90369048f60

    • SHA256

      2a2c7b507aad6d5693224073ecc6770676c51f9ce89faaf3938f17a6f6357803

    • SHA512

      491fc661ca900f8f5084f47292a8f14c2b1d59f5f612287de414b191c173e4793f8a9b2e6a9d7a6ee0077ce54dad8bf6e352642f90c3b84f30254988958e7fad

    • SSDEEP

      3072:xcpEtHu5X8Qb8OVdO21MlFUPcOGHw+22YDCBNP8kyXaJ61M/9Vnr:xiEtHu58Qb8Yb9GHw+2jDqNuXaJQM/9F

    Score
    9/10
    credential_accessdefense_evasiondiscovery

    • Contacts a large (23688) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

    • Reads process memory

      Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

      credential_access
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks