046073ea4485417bfe53a2d0b9e8c8afe4fc6f8aa2cec233d517707d0bf47525

Analysis

max time kernel
131s
max time network
147s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
03/02/2025, 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EdiAf.x86.elf
Size

62KB
MD5

a2dfe2560bc82b1df167f014b74607d4
SHA1

8b3594b9613a4b440ec8460e878a6cda9ea1b0f6
SHA256

046073ea4485417bfe53a2d0b9e8c8afe4fc6f8aa2cec233d517707d0bf47525
SHA512

21148fdb9c50ab6ce535bca9a65e2f6e310afd65e4d5df64bc0093f1f10aaa32068d1ac17f0085bcc58bb50941472ef893818d617eff94864a7e505f1da85804
SSDEEP

1536:yhHf5RgcvJp+2GPWsFAptQpoYg9YIfKouCF9i5pihOhVAFbfVt:yhHRRgcvO2G1cCoYg2ouvMhWCJfb

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid
1565

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

Writes file to system bin folder 2 IoCs

description	ioc
File opened for modification	/bin/watchdog
File opened for modification	/sbin/watchdog

Changes its process name 1 IoCs

description	pid
Changes the process name, possibly in an attempt to hide itself	1565

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc
File opened for reading	/proc/self/maps

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...