Analysis
-
max time kernel
11571s -
max time network
121s -
platform
linux_mipsel -
resource
debian9-mipsel-en-20211208 -
submitted
21-04-2022 15:31
Static task
static1
Behavioral task
behavioral1
Sample
.i
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral2
Sample
.i
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral3
Sample
.i
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral4
Sample
.i
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
.i
-
Size
83KB
-
MD5
b8ed2cb3e9fedec5b164ce84ad5a08d0
-
SHA1
b45ef9ad0a29b0a402d1613b10c3f6e95686230c
-
SHA256
d5601202dff3017db238145ff21857415f663031aca9b3d534bec8991b12179a
-
SHA512
98aa6abf6bc6b27ea2833122c468e436c267ef40c5ecbbd6446174d0859920e7b7bbcec617e12d7aa9e89e0492e5dcf4cf49a6208e7252fd0619047818454a31
Malware Config
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
Processes:
description ioc /etc/hosts /etc/hosts -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
Processes:
.idescription ioc process /proc/net/route /proc/net/route .i -
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
.idescription ioc process /proc/net/route /proc/net/route .i /proc/net/tcp /proc/net/tcp /proc/net/tcp6 /proc/net/tcp6 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc /proc/115/cmdline /proc/115/cmdline /proc/8/cmdline /proc/8/cmdline /proc/1/cmdline /proc/1/cmdline /proc/256/fd /proc/256/fd /proc/146/cmdline /proc/146/cmdline /proc/36/cmdline /proc/36/cmdline /proc/17/cmdline /proc/17/cmdline /proc/10/cmdline /proc/10/cmdline /proc/327/fd /proc/327/fd /proc/208/cmdline /proc/208/cmdline /proc/77/cmdline /proc/77/cmdline /proc/76/cmdline /proc/76/cmdline /proc/21/cmdline /proc/21/cmdline /proc/6/cmdline /proc/6/cmdline /proc/269/cmdline /proc/269/cmdline /proc/251/cmdline /proc/251/cmdline /proc/233/cmdline /proc/233/cmdline /proc/22/cmdline /proc/22/cmdline /proc/20/cmdline /proc/20/cmdline /proc/327/cmdline /proc/327/cmdline /proc/323/cmdline /proc/323/cmdline /proc/116/cmdline /proc/116/cmdline /proc/70/cmdline /proc/70/cmdline /proc/293/fd /proc/293/fd /proc/222/fd /proc/222/fd /proc/208/fd /proc/208/fd /proc/2/cmdline /proc/2/cmdline /proc/235/fd /proc/235/fd /proc/219/cmdline /proc/219/cmdline /proc/82/cmdline /proc/82/cmdline /proc/73/cmdline /proc/73/cmdline /proc/326/cmdline /proc/326/cmdline /proc/307/fd /proc/307/fd /proc/300/cmdline /proc/300/cmdline /proc/252/fd /proc/252/fd /proc/71/cmdline /proc/71/cmdline /proc/306/cmdline /proc/306/cmdline /proc/252/cmdline /proc/252/cmdline /proc/80/cmdline /proc/80/cmdline /proc/256/cmdline /proc/256/cmdline /proc/37/cmdline /proc/37/cmdline /proc/16/cmdline /proc/16/cmdline /proc/11/cmdline /proc/11/cmdline /proc/23/cmdline /proc/23/cmdline /proc/18/cmdline /proc/18/cmdline /proc/13/cmdline /proc/13/cmdline /proc/233/fd /proc/233/fd /proc/74/cmdline /proc/74/cmdline /proc/157/cmdline /proc/157/cmdline /proc/15/cmdline /proc/15/cmdline /proc/14/cmdline /proc/14/cmdline /proc/7/cmdline /proc/7/cmdline /proc/306/fd /proc/306/fd /proc/293/cmdline /proc/293/cmdline /proc/260/cmdline /proc/260/cmdline /proc/222/cmdline /proc/222/cmdline /proc/3/cmdline /proc/3/cmdline /proc/157/fd /proc/157/fd /proc/105/cmdline /proc/105/cmdline /proc/12/cmdline /proc/12/cmdline /proc/9/cmdline /proc/9/cmdline /proc/1/fd /proc/1/fd /proc/326/fd /proc/326/fd /proc/300/fd /proc/300/fd -
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes:
description ioc /tmp/ftpupload.sh /tmp/ftpupload.sh /tmp/ftpupdate.sh /tmp/ftpupdate.sh
Processes
-
./.i./.i1⤵
- Reads system routing table
- Reads system network configuration
PID:325
-
/bin/shsh -c "iptables -A INPUT -p tcp --destination-port 23 -j DROP"1⤵PID:330
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 23 -j DROP2⤵PID:331
-
-
/bin/shsh -c "iptables -A INPUT -p tcp --destination-port 7547 -j DROP"1⤵PID:336
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 7547 -j DROP2⤵PID:337
-
-
/bin/shsh -c "iptables -A INPUT -p tcp --destination-port 5555 -j DROP"1⤵PID:338
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 5555 -j DROP2⤵PID:339
-
-
/bin/shsh -c "iptables -A INPUT -p tcp --destination-port 5358 -j DROP"1⤵PID:340
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 5358 -j DROP2⤵PID:341
-
-
/bin/shsh -c "iptables -D INPUT -j CWMP_CR"1⤵PID:342
-
/sbin/iptablesiptables -D INPUT -j CWMP_CR2⤵PID:343
-
-
/bin/shsh -c "iptables -X CWMP_CR"1⤵PID:344
-
/sbin/iptablesiptables -X CWMP_CR2⤵PID:345
-
-
/bin/shsh -c "iptables -I INPUT -p udp --dport 9269 -j ACCEPT"1⤵PID:346
-
/sbin/iptablesiptables -I INPUT -p udp --dport 9269 -j ACCEPT2⤵PID:347
-