fd81d8a0be2c12f5850617967249d2146dff59435168b2887e99909f271f5081

Analysis

max time kernel
14372s
max time network
153s
platform
linux_mipsel
resource
debian9-mipsel-en-20211208
submitted
24-05-2022 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd81d8a0be2c12f5850617967249d2146dff59435168b2887e99909f271f5081
Size

89KB
MD5

623a8f1abb5800afe3e1a9d86c426805
SHA1

f54f7c85c26b92a6e1e09bce5e393f368154bb09
SHA256

fd81d8a0be2c12f5850617967249d2146dff59435168b2887e99909f271f5081
SHA512

c4b70c0417cc88da9f7aad73fece297d9358ef56a91e63f057722f9de69368c1efc9fb6b18364c9f97f4b762d67d6ea1c65c82c8f7d6c6156d363e2951f56020

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (20390) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

Processes:

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

Processes:

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
/proc/157/fd	/proc/157/fd
/proc/233/fd	/proc/233/fd
/proc/252/fd	/proc/252/fd
/proc/269/fd	/proc/269/fd
/proc/307/fd	/proc/307/fd
/proc/331/fd	/proc/331/fd
/proc/142/fd	/proc/142/fd
/proc/222/fd	/proc/222/fd
/proc/251/fd	/proc/251/fd
/proc/256/fd	/proc/256/fd
/proc/306/fd	/proc/306/fd
/proc/	/proc/
/proc/1/fd	/proc/1/fd
/proc/208/fd	/proc/208/fd
/proc/293/fd	/proc/293/fd
/proc/326/fd	/proc/326/fd
/proc/328/fd	/proc/328/fd
/proc/329/fd	/proc/329/fd
/proc/219/fd	/proc/219/fd
/proc/235/fd	/proc/235/fd
/proc/300/fd	/proc/300/fd
/proc/332/fd	/proc/332/fd
/proc/326/exe	/proc/326/exe

./fd81d8a0be2c12f5850617967249d2146dff59435168b2887e99909f271f5081
./fd81d8a0be2c12f5850617967249d2146dff59435168b2887e99909f271f5081
1⤵
PID:325

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Scanning

T1046

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads