518668d64e5e5ec824bb002f8860c4142f0cacdb8e72a9f76b73ae30f1474007

Analysis

max time kernel
19172s
max time network
154s
platform
linux_mips
resource
debian9-mipsbe-en-20211208
resource tags

arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
18/07/2022, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

89.42.133.67/mips
Size

151KB
MD5

0c842eed0ddb8e115955c6bae24b5624
SHA1

396940a28525aab9b3221af0e32a899e5b6acfe5
SHA256

1eaeee119c1d91059c1f9fb5e945592fb021615ac6f57edce3c5becb20488f9e
SHA512

b26e191e4947767456ec5b06fec156b763f6df65a91de5db894e8e96cebc1cc63637cf0865888a792bad994ece0df9b80efb313cc22e564ec58ab8a394ec4d37

Score

9^/10

Malware Config

Signatures

Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

T1016

description	ioc	Process
/proc/net/route	/proc/net/route	mips

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
/proc/net/route	/proc/net/route	mips

/tmp/89.42.133.67/mips
/tmp/89.42.133.67/mips
1⤵
- Reads system routing table
- Reads system network configuration
PID:320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads