ae9421654fd6cbd8ddbf85ba86c8a69bcdeea6a4636f8d70a4a5b0a9d7dbabf4

Analysis

max time kernel
149s
max time network
155s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
02-02-2025 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae9421654fd6cbd8ddbf85ba86c8a69bcdeea6a4636f8d70a4a5b0a9d7dbabf4.elf
Size

62KB
MD5

74245827038cff4516dd63a9f7ffd2e9
SHA1

8e718e98a7adc1977bd2a6b98664952a14434bd9
SHA256

ae9421654fd6cbd8ddbf85ba86c8a69bcdeea6a4636f8d70a4a5b0a9d7dbabf4
SHA512

08865640725d01dc8731afcc69e9a2e26c8b41172cf2ea41bcc852295bc283fed88c984080174fa43727d99c021117808a384902cb4713a445ee313ba762ac0f
SSDEEP

768:icPMINixzSfNNgDwexT5t4qaRHwRUYt9I8HnKfQuRYlyB5BOBaB1BcBzBB/0KXyV:dNp0DwET5Iv6p0KXyGkc1z97pk

Score

7^/10

defense_evasion

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
700	ae9421654fd6cbd8ddbf85ba86c8a69bcdeea6a4636f8d70a4a5b0a9d7dbabf4.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	ae9421654fd6cbd8ddbf85ba86c8a69bcdeea6a4636f8d70a4a5b0a9d7dbabf4.elf
File opened for modification	/dev/misc/watchdog	ae9421654fd6cbd8ddbf85ba86c8a69bcdeea6a4636f8d70a4a5b0a9d7dbabf4.elf

Renames itself 1 IoCs

pid	Process
700	ae9421654fd6cbd8ddbf85ba86c8a69bcdeea6a4636f8d70a4a5b0a9d7dbabf4.elf

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	81.169.136.222

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	700	ae9421654fd6cbd8ddbf85ba86c8a69bcdeea6a4636f8d70a4a5b0a9d7dbabf4.elf

/tmp/ae9421654fd6cbd8ddbf85ba86c8a69bcdeea6a4636f8d70a4a5b0a9d7dbabf4.elf
/tmp/ae9421654fd6cbd8ddbf85ba86c8a69bcdeea6a4636f8d70a4a5b0a9d7dbabf4.elf
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Renames itself
- Changes its process name
PID:700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads