Overview

overview

9

Static

static

b04c2c2e76...85d487

linux_mips

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b04c2c2e768f2036a49291a24a85d487

  • Size

    97KB

  • Sample

    220524-pg6pdsdeen

  • MD5

    b04c2c2e768f2036a49291a24a85d487

  • SHA1

    41a3faa49a8e9106279c8e3575868208c619057c

  • SHA256

    04315a61a09947ceceb167f5740666300225007375c150a9f828f57fce370901

  • SHA512

    94fd48fa8a27c08afcdc5dadb136989b040a69166649400a28d8c576b5a6848b15f22d23754f7757c14b64d978a7bf9a2b3d0855819fd06cb5f7ad64d2dd0e05

Score
9/10
discoverylinux

Malware Config

Targets

    • Target

      b04c2c2e768f2036a49291a24a85d487

    • Size

      97KB

    • MD5

      b04c2c2e768f2036a49291a24a85d487

    • SHA1

      41a3faa49a8e9106279c8e3575868208c619057c

    • SHA256

      04315a61a09947ceceb167f5740666300225007375c150a9f828f57fce370901

    • SHA512

      94fd48fa8a27c08afcdc5dadb136989b040a69166649400a28d8c576b5a6848b15f22d23754f7757c14b64d978a7bf9a2b3d0855819fd06cb5f7ad64d2dd0e05

    Score
    9/10
    discovery

    • Contacts a large (20596) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks