Analysis
-
max time kernel
123s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
20/03/2025, 04:38
Behavioral task
behavioral1
Sample
f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf
Resource
debian9-mipsbe-20240418-en
debian-9-mips
8 signatures
150 seconds
General
-
Target
f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf
-
Size
74KB
-
MD5
80cc3593d846a47aa9b3b8d61111d13b
-
SHA1
9222d0efcf42c5f72af22ff5324a17ee0e752115
-
SHA256
f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48
-
SHA512
f3285435878e3aa7071ee18de38c3b81230344cff48b85735b2a499e820aaa8daf907e460d4fcd16ab2b4a1d9eabf5daeee92823223d6956efafcda0aa0689f5
-
SSDEEP
1536:aHy7eP768Dky5FGxZMeYpCVM6+eeLMLMrZyCRBWcXPbbBRhO:RePm8Dix+eYp+M6+TMQZdEcXPbs
Score
9/10
Malware Config
Signatures
-
Contacts a large (68155) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for modification /dev/misc/watchdog f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf -
Renames itself 1 IoCs
pid Process 712 f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 194.36.144.87 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself bioset 712 f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf -
description ioc Process File opened for reading /proc/326/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/19/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/22/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/1/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/11/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/121/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/20/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/24/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/427/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/707/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/2/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/21/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/37/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/207/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/688/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/18/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/80/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/111/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/318/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/36/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/13/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/16/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/74/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/75/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/148/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/383/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/671/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/15/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/82/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/173/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/672/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/709/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/711/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/6/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/71/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/72/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/234/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/319/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/320/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/325/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/703/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/4/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/9/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/323/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/14/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/12/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/712/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/3/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/73/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/76/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/668/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/378/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/379/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/665/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/5/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/7/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/23/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/77/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/702/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/8/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/10/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/122/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/17/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf File opened for reading /proc/70/comm f67bdb0d3d4dde55d7ef7c9ad25a8e068d7ac5ac084fba3b2a9c40d36b13aa48.elf