Analysis
-
max time kernel
14179s -
max time network
158s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
submitted
21-05-2022 19:04
Static task
static1
Behavioral task
behavioral1
Sample
2c1ced87bdfe47991f6457e382ca2642f968d71eb5086424a11d41661ad6a551
Resource
debian9-armhf-en-20211208
General
-
Target
2c1ced87bdfe47991f6457e382ca2642f968d71eb5086424a11d41661ad6a551
-
Size
116KB
-
MD5
576bf85eb2b09c1525482eed251add2d
-
SHA1
9c403fe42671bb29ea6d970a2e80ea98360b8dc1
-
SHA256
2c1ced87bdfe47991f6457e382ca2642f968d71eb5086424a11d41661ad6a551
-
SHA512
bf289aa0a97345be8cbcaed8df0f7a6476b8bcf7a0e65431f440208f4652fc00533cfe6abffd5aaacf91abb3f9938bb3d32a6f96f7bba4c1efad4b67e199f6e1
Malware Config
Signatures
-
Contacts a large (52035) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc /bin/watchdog /bin/watchdog /sbin/watchdog /sbin/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 22 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc /proc/ /proc/ /proc/235/fd /proc/235/fd /proc/270/fd /proc/270/fd /proc/320/fd /proc/320/fd /proc/278/fd /proc/278/fd /proc/316/fd /proc/316/fd /proc/stat /proc/stat /proc/1/fd /proc/1/fd /proc/139/fd /proc/139/fd /proc/161/fd /proc/161/fd /proc/226/fd /proc/226/fd /proc/236/fd /proc/236/fd /proc/323/fd /proc/323/fd /proc/368/fd /proc/368/fd /proc/208/fd /proc/208/fd /proc/238/fd /proc/238/fd /proc/287/fd /proc/287/fd /proc/363/fd /proc/363/fd /proc/269/fd /proc/269/fd /proc/322/fd /proc/322/fd /proc/365/fd /proc/365/fd /proc/367/fd /proc/367/fd