fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802

Analysis

max time kernel
150s
max time network
151s
platform
debian-12_mipsel
resource
debian12-mipsel-20240729-en
resource tags

arch:mipselimage:debian12-mipsel-20240729-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
13-02-2025 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
Size

5.6MB
MD5

cfa76444048616e814928a88af3a27e9
SHA1

04bf106b0437f00c26ccc8d6cec67af0e426ef00
SHA256

fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802
SHA512

d78f8311eb3403ee1d763a52c7adb77e8cb1c70c4a0efe5575402c478417102465e4ae7b93a9d539f4e8a961efdeb6659edfcc7321b3579d3c873c4c25e2bf6f
SSDEEP

98304:yC91hAFxvW6WGVqq7g3JDCg76dAuE8iW5ay5mIOX+aaNcc8pNkxXkz8xBs3K4HUk:yC91hAFxvW6WGVqq7g3JDCg76dAuE8ib

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Executes dropped EXE 1 IoCs

ioc	pid	Process
/etc/32678	767	sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for modification	/dev/misc/watchdog	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/linux_kill	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/usr/lib/systemd/system/linux.service	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	journalctl
File opened for reading	/proc/885/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/425/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/809/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/818/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/764/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/780/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/800/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/841/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/874/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/879/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/900/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/390/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/712/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/779/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/816/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/878/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/877/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/699/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/778/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/805/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/902/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/903/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/379/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/876/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/811/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/813/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/865/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/694/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/661/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/767/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/sys/kernel/random/boot_id	journalctl
File opened for reading	/proc/904/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/893/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/714/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/718/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/860/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/810/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/671/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/763/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/798/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/732/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/859/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/869/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/880/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/380/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/783/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/722/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/867/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/883/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/806/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/822/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/886/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/350/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/711/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/752/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/733/stat	fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	audit2allow

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	9	Go-http-client/1.1

/tmp/fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
/tmp/fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
1⤵
- Enumerates kernel/hardware configuration
PID:742
- /usr/bin/sh
  sh -c "/etc/32678&"
  2⤵
  - Executes dropped EXE
  PID:762
- /usr/sbin/service
  service crond start
  2⤵
  PID:763
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:768
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:775
- - /usr/bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    - Reads runtime system information
    PID:780
- - /usr/bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    PID:779
- /tmp/fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf
  /tmp/fc449e7ed4c667a93339d2a23bf422547048bb5905afc23d947fb5f5581f2802.elf " "
  2⤵
  - Modifies Watchdog functionality
  - Modifies init.d
  - Modifies systemd
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:764
- - /usr/sbin/update-rc.d
    update-rc.d linux_kill defaults
    3⤵
    PID:788
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:801
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:801
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:801
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads runtime system information
      PID:801
- - /usr/bin/sh
    sh -c "cd /boot;systemctl daemon-reload;systemctl enable linux.service;systemctl start linux.service;journalctl -xe --no-pager"
    3⤵
    PID:822
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads runtime system information
      PID:823
  - - /usr/bin/systemctl
      systemctl enable linux.service
      4⤵
      Reads runtime system information
      PID:841
  - - /usr/bin/systemctl
      systemctl start linux.service
      4⤵
      Reads runtime system information
      PID:859
  - - /usr/bin/journalctl
      journalctl -xe --no-pager
      4⤵
      Reads runtime system information
      PID:874
- - /usr/bin/sh
    sh -c "cd /boot;ausearch -c 'System.img.conf' --raw | audit2allow -M my-Systemimgconf;semodule -X 300 -i my-Systemimgconf.pp"
    3⤵
    PID:881
  - - /usr/sbin/ausearch
      ausearch -c System.img.conf --raw
      4⤵
      PID:882
  - - /usr/bin/audit2allow
      audit2allow -M my-Systemimgconf
      4⤵
      Reads runtime system information
      PID:883

/etc/32678
/etc/32678
1⤵
PID:767
- /usr/bin/sleep
  sleep 60
  2⤵
  PID:774

/usr/local/sbin/systemctl
systemctl start crond.service
1⤵
PID:763

/usr/local/bin/systemctl
systemctl start crond.service
1⤵
PID:763

/usr/sbin/systemctl
systemctl start crond.service
1⤵
PID:763

/usr/bin/systemctl
systemctl start crond.service
1⤵
- Reads runtime system information
PID:763

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/32678

Filesize
61B

MD5
768eaf287796da19e1cf5e0b2fb1b161

SHA1
6a1ce2ee5ccc86d1f33806feb14547b35290df2a

SHA256
1d22620dfb2a6715e5d745aed5cf841ede0e75e1747f12b9b925a2d346bc7ecb

SHA512
e6af30c9df4f7f47696069511e64ecbc8e841629d692ee4056503df3533fb7a7a74960698826260355e1dba7b6c562482a27a39bb51a4237473ce4b68472d620

Download Submit
/etc/init.d/linux_kill

Filesize
189B

MD5
3909975f7cc0d1121c1819b800069f31

SHA1
3e68de708c2e6c40fab6794afdee3104e5590189

SHA256
6876dac71f13a068afb863d257134275f2edba43b2acaf4924fabf97c079070b

SHA512
50600cceeb03b05f45ae61d890caee9f51ff390b6776930866e527e071d65d08241fc66673fd9b99d62fbc77d3c00fc3de4d7378cbc42f5daba5d83072b0906e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads