59de6bfdd9ed67d803bc062b5f2234fa76e339833f99963e41ca744330d14005

Analysis

max time kernel
24702s
max time network
146s
platform
linux_mips
resource
debian9-mipsbe-en-20211208
resource tags

arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
20/09/2022, 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mips-20220920-1445.elf
Size

98KB
MD5

06eb87e3e0271a898a647e57e0e12481
SHA1

c76d81da9ea13e79a8a799dd6014cd4f2f3af511
SHA256

59de6bfdd9ed67d803bc062b5f2234fa76e339833f99963e41ca744330d14005
SHA512

d48a590a964721ed58c5e8dc27a3bee796700c45d809f3deb0f57e2a809227e497b59879e53351bfbe9d2edf5e8d1d31e9f59c09358d9409e4572310961f7856
SSDEEP

768:L8tDHzromzMYPQ8EL89els9F1jcAYjbPIEx02rKJLo+4A3Iabx31t10W34V6k3yo:4D1YzUF1YpXWJLo+4A3IaV3+JceZtXAy

Score

7^/10

Malware Config

Signatures

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads runtime system information 22 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/308/fd	/proc/308/fd	Process not Found
/proc/334/fd	/proc/334/fd	Process not Found
/proc/295/fd	/proc/295/fd	Process not Found
/proc/299/fd	/proc/299/fd	Process not Found
/proc/155/fd	/proc/155/fd	Process not Found
/proc/207/fd	/proc/207/fd	Process not Found
/proc/222/fd	/proc/222/fd	Process not Found
/proc/327/fd	/proc/327/fd	Process not Found
/proc/333/fd	/proc/333/fd	Process not Found
/proc/filesystems	/proc/filesystems	mv
/proc/	/proc/	Process not Found
/proc/251/fd	/proc/251/fd	Process not Found
/proc/252/fd	/proc/252/fd	Process not Found
/proc/filesystems	/proc/filesystems	mkdir
/proc/224/fd	/proc/224/fd	Process not Found
/proc/225/fd	/proc/225/fd	Process not Found
/proc/226/fd	/proc/226/fd	Process not Found
/proc/255/fd	/proc/255/fd	Process not Found
/proc/273/fd	/proc/273/fd	Process not Found
/proc/307/fd	/proc/307/fd	Process not Found
/proc/1/fd	/proc/1/fd	Process not Found
/proc/142/fd	/proc/142/fd	Process not Found

/tmp/mips-20220920-1445.elf
/tmp/mips-20220920-1445.elf
1⤵
PID:324

/bin/sh
sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/mips-20220920-1445.elf bin/systemd; chmod 777 bin/systemd"
1⤵
PID:325
- /bin/rm
  rm -rf bin/systemd
  2⤵
  PID:326
- /bin/mkdir
  mkdir bin
  2⤵
  - Reads runtime system information
  PID:330
- /bin/mv
  mv /tmp/mips-20220920-1445.elf bin/systemd
  2⤵
  - Reads runtime system information
  PID:331
- /bin/chmod
  chmod 777 bin/systemd
  2⤵
  PID:332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...