a06645dcacd00b2ffa5db96729241c355e012fa87a2ef16d595a4bac7a7dcd10

Analysis

max time kernel
0s
max time network
43s
platform
linux_mipsel
resource
debian9-mipsel-en-20211208
submitted
09-12-2021 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdc02fe5c4e820cc750d4b5b7280f2cd
Size

31KB
MD5

bdc02fe5c4e820cc750d4b5b7280f2cd
SHA1

d49ff96bbfbd990ffdb4727a809b97eb05bf1c2a
SHA256

a06645dcacd00b2ffa5db96729241c355e012fa87a2ef16d595a4bac7a7dcd10
SHA512

5761b1230316be14335fb19f0d441377a16b28e4a809d77e9cd08da48d99c3e4ad14cd135cac186094c20cb245faa8d41d950540941e0686b70bb68cd39990bb

Score

9^/10

Malware Config

Signatures

Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

description ioc

/proc/net/tcp /proc/net/tcp
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

description ioc

/proc/net/tcp /proc/net/tcp

description	ioc
/proc/net/tcp	/proc/net/tcp

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
/proc/301/fd	/proc/301/fd
/proc/328/fd	/proc/328/fd
/proc/	/proc/
/proc/156/fd	/proc/156/fd
/proc/225/fd	/proc/225/fd
/proc/251/fd	/proc/251/fd
/proc/258/fd	/proc/258/fd
/proc/282/fd	/proc/282/fd
/proc/284/fd	/proc/284/fd
/proc/334/fd	/proc/334/fd
/proc/141/fd	/proc/141/fd
/proc/228/fd	/proc/228/fd
/proc/250/fd	/proc/250/fd
/proc/330/fd	/proc/330/fd
/proc/333/fd	/proc/333/fd
/proc/224/fd	/proc/224/fd
/proc/291/fd	/proc/291/fd
/proc/300/fd	/proc/300/fd
/proc/331/fd	/proc/331/fd
/proc/331/exe	/proc/331/exe
/proc/1/fd	/proc/1/fd
/proc/209/fd	/proc/209/fd
/proc/229/fd	/proc/229/fd

./bdc02fe5c4e820cc750d4b5b7280f2cd
./bdc02fe5c4e820cc750d4b5b7280f2cd
1⤵
PID:327

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Connections Discovery

T1049

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads