04315a61a09947ceceb167f5740666300225007375c150a9f828f57fce370901

Analysis

max time kernel
14411s
max time network
153s
platform
linux_mips
resource
debian9-mipsbe-en-20211208
submitted
24-05-2022 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b04c2c2e768f2036a49291a24a85d487
Size

97KB
MD5

b04c2c2e768f2036a49291a24a85d487
SHA1

41a3faa49a8e9106279c8e3575868208c619057c
SHA256

04315a61a09947ceceb167f5740666300225007375c150a9f828f57fce370901
SHA512

94fd48fa8a27c08afcdc5dadb136989b040a69166649400a28d8c576b5a6848b15f22d23754f7757c14b64d978a7bf9a2b3d0855819fd06cb5f7ad64d2dd0e05

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (20596) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

Processes:

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

Processes:

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
/proc/281/fd	/proc/281/fd
/proc/290/fd	/proc/290/fd
/proc/1/fd	/proc/1/fd
/proc/204/fd	/proc/204/fd
/proc/216/fd	/proc/216/fd
/proc/217/fd	/proc/217/fd
/proc/243/fd	/proc/243/fd
/proc/280/fd	/proc/280/fd
/proc/291/fd	/proc/291/fd
/proc/323/fd	/proc/323/fd
/proc/	/proc/
/proc/155/fd	/proc/155/fd
/proc/242/fd	/proc/242/fd
/proc/212/fd	/proc/212/fd
/proc/214/fd	/proc/214/fd
/proc/321/fd	/proc/321/fd
/proc/326/fd	/proc/326/fd
/proc/328/fd	/proc/328/fd
/proc/138/fd	/proc/138/fd
/proc/249/fd	/proc/249/fd
/proc/273/fd	/proc/273/fd
/proc/324/fd	/proc/324/fd
/proc/321/exe	/proc/321/exe

./b04c2c2e768f2036a49291a24a85d487
./b04c2c2e768f2036a49291a24a85d487
1⤵
PID:320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Scanning

T1046

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads