Analysis
-
max time kernel
149s -
max time network
149s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
20/03/2025, 04:22
Behavioral task
behavioral1
Sample
e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf
Resource
debian12-armhf-20240418-en
debian-12-armhf
6 signatures
150 seconds
General
-
Target
e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf
-
Size
68KB
-
MD5
54f7d591c06590713bf71fe59e9e49aa
-
SHA1
f14561a46d3987904225ab149d6993f44f71e464
-
SHA256
e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867
-
SHA512
6aa1592dfc7a874afe7920dda00230a50db50859f8765b0c3da4e93e5c85c2fbfc2de0660dd7aee4487a1731a780ff665b61f87dd3d174226ea9948065a8bfb8
-
SSDEEP
1536:a9nHmozeWGAKmC37/4h49HhMtc7u0eqw9p9lKNiAaOj3lXPa:TozsAS7/4C9BMtc7u0eqxXaOTlXPa
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for modification /dev/misc/watchdog e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf -
Renames itself 1 IoCs
pid Process 705 e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 81.169.136.222 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself auditd 705 e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf -
description ioc Process File opened for reading /proc/35/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/315/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/325/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/23/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/45/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/51/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/203/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/252/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/317/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/342/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/8/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/10/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/17/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/24/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/26/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/344/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/646/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/323/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/3/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/6/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/28/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/645/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/681/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/684/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/56/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/141/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/142/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/14/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/29/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/34/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/46/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/663/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/704/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/220/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/5/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/16/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/27/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/33/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/628/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/707/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/42/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/705/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/9/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/19/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/30/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/186/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/193/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/313/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/341/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/680/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/13/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/22/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/44/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/57/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/703/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/706/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/2/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/12/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/661/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/1/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/4/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/7/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/15/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf File opened for reading /proc/18/comm e516c2a08a07ce8407f47f02181ab05d2c4a8fd7ac5c9e3a423db4c390a14867.elf