Analysis
-
max time kernel
0s -
max time network
2s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
20/03/2025, 04:33
Behavioral task
behavioral1
Sample
f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf
Resource
debian9-mipsbe-20240729-en
debian-9-mips
6 signatures
150 seconds
General
-
Target
f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf
-
Size
74KB
-
MD5
80cc3593d846a47aa9b3b8d61111d13b
-
SHA1
9222d0efcf42c5f72af22ff5324a17ee0e752115
-
SHA256
f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48
-
SHA512
f3285435878e3aa7071ee18de38c3b81230344cff48b85735b2a499e820aaa8daf907e460d4fcd16ab2b4a1d9eabf5daeee92823223d6956efafcda0aa0689f5
-
SSDEEP
1536:aHy7eP768Dky5FGxZMeYpCVM6+eeLMLMrZyCRBWcXPbbBRhO:RePm8Dix+eYp+M6+TMQZdEcXPbs
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for modification /dev/watchdog f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf -
Renames itself 1 IoCs
pid Process 723 f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 202.61.197.122 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself kblockd 723 f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf -
description ioc Process File opened for reading /proc/5/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/14/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/17/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/111/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/376/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/701/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/4/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/7/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/18/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/21/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/346/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/2/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/6/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/36/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/683/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/12/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/22/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/158/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/251/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/339/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/396/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/443/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/20/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/72/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/337/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/8/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/125/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/178/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/718/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/75/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/341/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/344/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/390/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/715/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/24/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/76/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/686/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/37/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/13/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/16/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/23/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/73/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/83/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/126/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/150/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/392/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/77/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/81/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/84/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/690/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/723/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/67/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/9/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/10/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/15/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/19/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/1/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/3/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/11/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/78/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/721/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/722/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/71/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/74/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf