Overview

overview

9

Static

static

b2ce11c94d...71c821

linux_mipsel

9

Analysis

  • max time kernel
    14176s
  • max time network
    152s
  • platform
    linux_mipsel
  • resource
    debian9-mipsel-en-20211208
  • submitted
    21-05-2022 19:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b2ce11c94dc994f269e1a678079de1c4876b71e85f119ef0b7b3685fa771c821

  • Size

    82KB

  • MD5

    95c69163be797be2017b8996ab530cbc

  • SHA1

    0dab9bdecd74900b20b83da667196200fa701954

  • SHA256

    b2ce11c94dc994f269e1a678079de1c4876b71e85f119ef0b7b3685fa771c821

  • SHA512

    f3766b23e702a20d8bdef63a380a13fa3e14c17652175aefa0fd396940199c1b5ffd63cf96439c65541fb50930dbb7592a0034b558bb64168f1d198d395ed8da

Score
9/10
discovery

Malware Config

Signatures

  • Contacts a large (41081) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Modifies the Watchdog daemon 1 TTPs

    Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets 1 TTPs 2 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 19 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • ./b2ce11c94dc994f269e1a678079de1c4876b71e85f119ef0b7b3685fa771c821
    ./b2ce11c94dc994f269e1a678079de1c4876b71e85f119ef0b7b3685fa771c821
    1⤵
    • Enumerates active TCP sockets
    • Reads system network configuration
    • Writes file to tmp directory
    PID:322

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Network Service Scanning

2
T1046

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads