Analysis
-
max time kernel
19172s -
max time network
157s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
resource tags
-
submitted
18-07-2022 14:41
General
-
Target
89.42.133.67/armv6l
-
Size
139KB
-
MD5
905ca647e9864f219d0bd0ff93cf428c
-
SHA1
25ac8bb5e88522700d63f81013123c0d4ff98620
-
SHA256
46273459b8fecd36e03f8769e71c5a54e4d417b878ed88a997e322d107efc1c1
-
SHA512
3ced13506bd84ea916a9eed641574fce5aea9561168680579f5c2cebdc621ba03b2325400ac32eb960f25d6d42b1dbb9b2267d0ecfafbef505e78dbeec5df633
Score
9/10
Malware Config
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/89.42.133.67/armv6l/tmp/89.42.133.67/armv6l1⤵
- Reads system routing table
- Reads system network configuration