Analysis
-
max time kernel
146s -
max time network
146s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
15/04/2025, 01:04
Behavioral task
behavioral1
Sample
2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf
Resource
debian9-armhf-20240729-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf
-
Size
50KB
-
MD5
0cfb71155d5e577a5d73f0cc28ec3790
-
SHA1
e7dc00dec4e5b1b18a697c777dd369b7436a64b7
-
SHA256
2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa
-
SHA512
cccf5a69317d390da96ebbc7d4de4ff8a3bd22ac2c8083853273ce5a655cc36b90fcc50a144b49a6f678d1e5a9e595ef01b0ddb6aaab57b5d7d5c4209980901a
-
SSDEEP
768:zBiYJuDr9yDm0xeECZuyP+8C8gqsojeFughQ/hbjBoRNsms4d48g:kY0DyCZPW8C87qFu0Q5bjBovH
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for modification /dev/watchdog 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf -
Renames itself 1 IoCs
pid Process 670 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 130.61.69.123 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself systemd 670 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf -
description ioc Process File opened for reading /proc/668/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/43/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/150/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/662/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/25/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/4/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/7/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/24/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/302/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/622/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/80/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/301/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/304/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/600/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/14/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/23/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/140/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/101/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/15/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/19/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/22/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/1/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/21/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/27/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/168/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/306/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/340/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/597/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/13/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/9/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/26/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/670/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/16/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/20/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/41/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/42/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/146/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/291/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/598/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/665/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/17/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/667/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/111/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/141/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/237/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/2/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/6/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/12/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/28/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/109/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/339/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/655/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/11/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/18/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/112/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/303/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/325/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/663/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/10/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/29/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/327/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/669/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/3/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/8/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf