fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f

Analysis

max time kernel
124s
max time network
153s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
11/03/2025, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
Size

67KB
MD5

8b0befb4dc3bcd729a1532e8a1833e09
SHA1

908733bf3cc880b09386a578d9c3d62dbd0163fa
SHA256

fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f
SHA512

0da0f3fd3c691f0d7b19977962961f4e6cdcc42bde47ac8fdc087e91c9fc0eb660c0b764b7a9a8b293cc1296065ef3a39cb1f83af4f72b3f407837cf4d019b1d
SSDEEP

768:/5FfwfG+uy2OM1mLsaJjvTXk02XFo08OoB5EzeLneZReggk1Lt2KXiWUrzkW:/5FIe+uyBMQE97oBqqncRVgk1LE7z

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (138685) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for modification	/dev/misc/watchdog	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf

Renames itself 1 IoCs

pid	Process
707	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	194.36.144.87

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	ksmd	707	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/387/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/706/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/2/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/23/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/71/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/78/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/225/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/699/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/704/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/7/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/22/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/13/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/399/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/150/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/514/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/705/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/8/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/14/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/15/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/24/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/144/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/322/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/684/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/4/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/77/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/165/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/319/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/477/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/510/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/700/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/11/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/17/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/20/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/76/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/79/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/82/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/103/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/114/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/18/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/19/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/707/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/6/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/9/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/16/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/69/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/73/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/21/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/375/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/470/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/5/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/36/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/351/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/1/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/10/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/75/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/702/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/12/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/70/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/115/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/324/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/353/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/3/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/37/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
File opened for reading	/proc/74/comm	fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf

/tmp/fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
/tmp/fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f.elf
1⤵
- Modifies Watchdog functionality
- Renames itself
- Changes its process name
- Reads runtime system information
PID:707

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...