eccdc58f3ff38c4382bc1f9a99b78b246795b176a117755ca2193487bf977778

Analysis

max time kernel
0s
max time network
77s
platform
linux_mips
resource
debian9-mipsbe
submitted
27-07-2021 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0853f1c286493bac050426c11ac7134
Size

87KB
MD5

c0853f1c286493bac050426c11ac7134
SHA1

8c2968f39bb536e453957a025a901b09c03676c8
SHA256

eccdc58f3ff38c4382bc1f9a99b78b246795b176a117755ca2193487bf977778
SHA512

8871bfee5f435731d93dc41ee3ee2f819ddd2e9ed8372174acaf572e138e440b61489fefcb45722958457046af3484640a747febd208aefa01810f2f48432ea8

Score

9^/10

Malware Config

Signatures

Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

description ioc

/proc/net/tcp /proc/net/tcp
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

description ioc

/proc/net/tcp /proc/net/tcp

description	ioc
/proc/net/tcp	/proc/net/tcp

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads runtime system information 26 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
/proc/	/proc/
/proc/226/fd	/proc/226/fd
/proc/313/fd	/proc/313/fd
/proc/345/fd	/proc/345/fd
/proc/346/fd	/proc/346/fd
/proc/1/fd	/proc/1/fd
/proc/260/fd	/proc/260/fd
/proc/314/fd	/proc/314/fd
/proc/335/fd	/proc/335/fd
/proc/348/fd	/proc/348/fd
/proc/343/exe	/proc/343/exe
/proc/140/fd	/proc/140/fd
/proc/157/fd	/proc/157/fd
/proc/218/fd	/proc/218/fd
/proc/255/fd	/proc/255/fd
/proc/283/fd	/proc/283/fd
/proc/297/fd	/proc/297/fd
/proc/331/fd	/proc/331/fd
/proc/338/fd	/proc/338/fd
/proc/228/fd	/proc/228/fd
/proc/230/fd	/proc/230/fd
/proc/231/fd	/proc/231/fd
/proc/254/fd	/proc/254/fd
/proc/300/fd	/proc/300/fd
/proc/343/fd	/proc/343/fd
/proc/350/fd	/proc/350/fd

./c0853f1c286493bac050426c11ac7134
./c0853f1c286493bac050426c11ac7134
1⤵
PID:341

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Connections Discovery

T1049

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads