Overview

overview

9

Static

static

3bf7aa4cbe...edab63

linux_mips

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    3bf7aa4cbea7cb2f21a70dc422da45d3ea1c743f734de545775b565322edab63

  • Size

    87KB

  • Sample

    220703-k1d19scheq

  • MD5

    2a51ccc08b8e6c3596d8c872aa6fd552

  • SHA1

    0c4cb36c43649d6aec60299430836685263e8028

  • SHA256

    3bf7aa4cbea7cb2f21a70dc422da45d3ea1c743f734de545775b565322edab63

  • SHA512

    e5b38fb87d1610eeb32aace64a671f9dd9217cb4271fe4b45a233c15de5b32191a21769258105a8632f1e3a40164512ecfc918f6c16173ff519634b80a88e5b5

Score
9/10
discoverylinux

Malware Config

Targets

    • Target

      3bf7aa4cbea7cb2f21a70dc422da45d3ea1c743f734de545775b565322edab63

    • Size

      87KB

    • MD5

      2a51ccc08b8e6c3596d8c872aa6fd552

    • SHA1

      0c4cb36c43649d6aec60299430836685263e8028

    • SHA256

      3bf7aa4cbea7cb2f21a70dc422da45d3ea1c743f734de545775b565322edab63

    • SHA512

      e5b38fb87d1610eeb32aace64a671f9dd9217cb4271fe4b45a233c15de5b32191a21769258105a8632f1e3a40164512ecfc918f6c16173ff519634b80a88e5b5

    Score
    9/10
    discovery

    • Contacts a large (20070) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks