Analysis
-
max time kernel
149s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
08/03/2025, 11:20
Behavioral task
behavioral1
Sample
912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
7 signatures
150 seconds
General
-
Target
912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf
-
Size
72KB
-
MD5
eaabc7aad745c2d680ea6bfc9444abbb
-
SHA1
c1823744d9b6d8ebc3e268b769761816a3b7e707
-
SHA256
912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c
-
SHA512
371cb11d0555fe0ef01e36bc6fa798cc3526a4c813a64203651d3a6aa272d2146ab2823dcbff479b5a8dc413865d586d9f3f3919ce05fe51c5cce69621f81d98
-
SSDEEP
1536:tdn6SsyWpUI66PvdMg3+rh5z1OZtBlDwwOLtwyGn9a9luOZciYvxLr:ZsyWUgvdMA+947BlDwwOLtwyGLu+vxn
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for modification /dev/misc/watchdog 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf -
Renames itself 1 IoCs
pid Process 676 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 185.181.61.24 Destination IP 185.181.61.24 -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself kauditd 676 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf -
description ioc Process File opened for reading /proc/41/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/149/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/28/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/662/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/675/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/6/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/150/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/488/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/668/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/669/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/26/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/27/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/429/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/4/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/18/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/25/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/109/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/294/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/345/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/9/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/15/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/629/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/19/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/23/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/98/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/2/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/8/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/20/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/220/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/315/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/326/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/489/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/11/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/676/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/7/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/21/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/24/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/10/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/16/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/167/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/441/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/318/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/3/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/5/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/12/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/43/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/77/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/106/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/137/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/1/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/42/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/280/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/291/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/671/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/673/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/14/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/145/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/281/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/295/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/293/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/13/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/17/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/108/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf File opened for reading /proc/222/comm 912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c.elf