Analysis
- max time kernel
16369s - max time network
152s - platform
linux_mips - resource
debian9-mipsbe-en-20211208 - submitted
16/06/2022, 03:35
General
- Target 27b486faa94f48887797d5f2b75881387915bf551ea47febf47a3416c6b005b8
- Size 70KB
- Sample220616-d5nb6sdaa5
- SHA256 27b486faa94f48887797d5f2b75881387915bf551ea47febf47a3416c6b005b8
Score
10/10
Malware Config
Signatures
- suricata: ET MALWARE Dark Nexus IoT Variant User-Agent (Outbound)
suricata: ET MALWARE Dark Nexus IoT Variant User-Agent (Outbound)
- Contacts a large (21716) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Unexpected DNS network traffic destination 16 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes
-
./27b486faa94f48887797d5f2b75881387915bf551ea47febf47a3416c6b005b8./27b486faa94f48887797d5f2b75881387915bf551ea47febf47a3416c6b005b81⤵