6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2

Analysis

max time kernel
0s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
11/03/2025, 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
Size

74KB
MD5

6e5e926e7618f041a3be2305fd8cd5a6
SHA1

29b6b02a0b8959ff1769f34c3ffc55cf905f2ec8
SHA256

6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2
SHA512

96a9f7a233f419e8b135535a79417b17e956c089a868050567a68111fdb9906185aa0ac1dbd77878bd6bd3acd9820aaf57a8474b3060a87993347e36e8e6959b
SSDEEP

1536:AKBK31576PhI6QXCjsJlEVNXdTmZZ+ZMStuxjBrxv:HIF57yhI1dJqsIM9xjdV

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
File opened for modification	/dev/misc/watchdog	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf

Renames itself 1 IoCs

pid	Process
704	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf

Reads runtime system information 15 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/2/comm	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
File opened for reading	/proc/3/comm	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
File opened for reading	/proc/15/comm	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
File opened for reading	/proc/1/comm	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
File opened for reading	/proc/12/comm	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
File opened for reading	/proc/13/comm	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
File opened for reading	/proc/14/comm	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
File opened for reading	/proc/4/comm	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
File opened for reading	/proc/5/comm	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
File opened for reading	/proc/7/comm	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
File opened for reading	/proc/8/comm	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
File opened for reading	/proc/9/comm	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
File opened for reading	/proc/11/comm	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
File opened for reading	/proc/6/comm	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
File opened for reading	/proc/10/comm	6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf

/tmp/6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
/tmp/6cb427e528d9d6e68e43e97ff0f81ddd5768458159561d0fafdb5dffd0b6f7b2.elf
1⤵
- Modifies Watchdog functionality
- Renames itself
- Reads runtime system information
PID:704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...