Overview
overview
9Static
static
data/cowri...585337
debian-9-armhf
data/cowri...585337
debian-9-mips
data/cowri...585337
debian-9-mipsel
data/cowri...585337
ubuntu-18.04-amd64
data/cowri...2a836a
debian-9-armhf
data/cowri...2a836a
debian-9-mips
data/cowri...2a836a
debian-9-mipsel
data/cowri...2a836a
ubuntu-18.04-amd64
data/cowri...aa3de3
debian-9-armhf
9data/cowri...aa3de3
debian-9-mips
data/cowri...aa3de3
debian-9-mipsel
data/cowri...aa3de3
ubuntu-18.04-amd64
data/cowri...69f8f2
debian-9-armhf
data/cowri...69f8f2
debian-9-mips
data/cowri...69f8f2
debian-9-mipsel
data/cowri...69f8f2
ubuntu-18.04-amd64
data/cowri...96cec0
debian-9-armhf
data/cowri...96cec0
debian-9-mips
data/cowri...96cec0
debian-9-mipsel
data/cowri...96cec0
ubuntu-18.04-amd64
data/cowri...dd766c
debian-9-armhf
5data/cowri...dd766c
debian-9-mips
5data/cowri...dd766c
debian-9-mipsel
5data/cowri...dd766c
ubuntu-18.04-amd64
5data/cowri...f58ae9
debian-9-armhf
9data/cowri...f58ae9
debian-9-mips
9data/cowri...f58ae9
debian-9-mipsel
9data/cowri...f58ae9
ubuntu-18.04-amd64
9data/cowri...c8f85d
debian-9-armhf
data/cowri...c8f85d
debian-9-mips
data/cowri...c8f85d
debian-9-mipsel
data/cowri...c8f85d
ubuntu-18.04-amd64
Analysis
-
max time kernel
27078s -
max time network
156s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
resource tags
arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
18-10-2022 02:32
Static task
static1
Behavioral task
behavioral1
Sample
data/cowrie/downloads/0db4f8ea9c2fd15a3fa176534bacb8507660f7d0944fa1f11e889410e6585337
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral2
Sample
data/cowrie/downloads/0db4f8ea9c2fd15a3fa176534bacb8507660f7d0944fa1f11e889410e6585337
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral3
Sample
data/cowrie/downloads/0db4f8ea9c2fd15a3fa176534bacb8507660f7d0944fa1f11e889410e6585337
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral4
Sample
data/cowrie/downloads/0db4f8ea9c2fd15a3fa176534bacb8507660f7d0944fa1f11e889410e6585337
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral5
Sample
data/cowrie/downloads/394a862032b8d27a1dce87dfbadb814c9d2c1a26d067d4ea4ed6541c342a836a
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral6
Sample
data/cowrie/downloads/394a862032b8d27a1dce87dfbadb814c9d2c1a26d067d4ea4ed6541c342a836a
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral7
Sample
data/cowrie/downloads/394a862032b8d27a1dce87dfbadb814c9d2c1a26d067d4ea4ed6541c342a836a
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral8
Sample
data/cowrie/downloads/394a862032b8d27a1dce87dfbadb814c9d2c1a26d067d4ea4ed6541c342a836a
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral9
Sample
data/cowrie/downloads/a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral10
Sample
data/cowrie/downloads/a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral11
Sample
data/cowrie/downloads/a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral12
Sample
data/cowrie/downloads/a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral13
Sample
data/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral14
Sample
data/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral15
Sample
data/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral16
Sample
data/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral17
Sample
data/cowrie/downloads/b4cbc01ef78d6e36d470d2f6df077b4e4198ac0fdceb9f8087d9a20ed696cec0
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral18
Sample
data/cowrie/downloads/b4cbc01ef78d6e36d470d2f6df077b4e4198ac0fdceb9f8087d9a20ed696cec0
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral19
Sample
data/cowrie/downloads/b4cbc01ef78d6e36d470d2f6df077b4e4198ac0fdceb9f8087d9a20ed696cec0
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral20
Sample
data/cowrie/downloads/b4cbc01ef78d6e36d470d2f6df077b4e4198ac0fdceb9f8087d9a20ed696cec0
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral21
Sample
data/cowrie/downloads/dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral22
Sample
data/cowrie/downloads/dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral23
Sample
data/cowrie/downloads/dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral24
Sample
data/cowrie/downloads/dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral25
Sample
data/cowrie/downloads/fd5657061af78d879e64d780e5fada398258bc0f700068927e6e1fa992f58ae9
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral26
Sample
data/cowrie/downloads/fd5657061af78d879e64d780e5fada398258bc0f700068927e6e1fa992f58ae9
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral27
Sample
data/cowrie/downloads/fd5657061af78d879e64d780e5fada398258bc0f700068927e6e1fa992f58ae9
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral28
Sample
data/cowrie/downloads/fd5657061af78d879e64d780e5fada398258bc0f700068927e6e1fa992f58ae9
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral29
Sample
data/cowrie/downloads/ff6f81930943c96a37d7741cd547ad90295a9bd63b6194b2a834a1d32bc8f85d
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral30
Sample
data/cowrie/downloads/ff6f81930943c96a37d7741cd547ad90295a9bd63b6194b2a834a1d32bc8f85d
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral31
Sample
data/cowrie/downloads/ff6f81930943c96a37d7741cd547ad90295a9bd63b6194b2a834a1d32bc8f85d
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral32
Sample
data/cowrie/downloads/ff6f81930943c96a37d7741cd547ad90295a9bd63b6194b2a834a1d32bc8f85d
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
data/cowrie/downloads/a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3
-
Size
78KB
-
MD5
9b6c3518a91d23ed77504b5416bfb5b3
-
SHA1
0a2d170abbf5031566377b01431e3b82d342630a
-
SHA256
a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3
-
SHA512
b2b08d5d5e6c6708d88b793e9340a780d47b5dce61e0a3026b4cdea8a9e4cbf9824037255e4ea4a40fee5bce956485232376d4677ce72ccb6c7f00badd09956e
-
SSDEEP
1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBht5:8D+CAXFYQChaAUk5ljnQssL
Malware Config
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
Processes:
description ioc /etc/hosts /etc/hosts -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
Processes:
a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3description ioc process /proc/net/route /proc/net/route a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3 -
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3description ioc /proc/net/tcp /proc/net/tcp /proc/net/tcp6 /proc/net/tcp6 /proc/net/route /proc/net/route a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc /proc/236/cmdline /proc/236/cmdline /proc/21/cmdline /proc/21/cmdline /proc/20/cmdline /proc/20/cmdline /proc/17/cmdline /proc/17/cmdline /proc/369/cmdline /proc/369/cmdline /proc/320/cmdline /proc/320/cmdline /proc/278/cmdline /proc/278/cmdline /proc/238/cmdline /proc/238/cmdline /proc/238/fd /proc/238/fd /proc/226/cmdline /proc/226/cmdline /proc/359/cmdline /proc/359/cmdline /proc/41/cmdline /proc/41/cmdline /proc/6/cmdline /proc/6/cmdline /proc/4/cmdline /proc/4/cmdline /proc/2/cmdline /proc/2/cmdline /proc/1/fd /proc/1/fd /proc/235/fd /proc/235/fd /proc/139/cmdline /proc/139/cmdline /proc/18/cmdline /proc/18/cmdline /proc/12/cmdline /proc/12/cmdline /proc/322/cmdline /proc/322/cmdline /proc/269/fd /proc/269/fd /proc/139/fd /proc/139/fd /proc/42/cmdline /proc/42/cmdline /proc/25/cmdline /proc/25/cmdline /proc/236/fd /proc/236/fd /proc/145/cmdline /proc/145/cmdline /proc/13/cmdline /proc/13/cmdline /proc/10/cmdline /proc/10/cmdline /proc/369/fd /proc/369/fd /proc/135/cmdline /proc/135/cmdline /proc/15/cmdline /proc/15/cmdline /proc/3/cmdline /proc/3/cmdline /proc/1/cmdline /proc/1/cmdline /proc/323/cmdline /proc/323/cmdline /proc/22/cmdline /proc/22/cmdline /proc/14/cmdline /proc/14/cmdline /proc/364/fd /proc/364/fd /proc/95/cmdline /proc/95/cmdline /proc/16/cmdline /proc/16/cmdline /proc/365/cmdline /proc/365/cmdline /proc/316/cmdline /proc/316/cmdline /proc/27/cmdline /proc/27/cmdline /proc/323/fd /proc/323/fd /proc/270/cmdline /proc/270/cmdline /proc/226/fd /proc/226/fd /proc/26/cmdline /proc/26/cmdline /proc/23/cmdline /proc/23/cmdline /proc/322/fd /proc/322/fd /proc/269/cmdline /proc/269/cmdline /proc/235/cmdline /proc/235/cmdline /proc/208/fd /proc/208/fd /proc/131/cmdline /proc/131/cmdline /proc/74/cmdline /proc/74/cmdline /proc/7/cmdline /proc/7/cmdline /proc/365/fd /proc/365/fd /proc/320/fd /proc/320/fd /proc/287/cmdline /proc/287/cmdline /proc/43/cmdline /proc/43/cmdline /proc/19/cmdline /proc/19/cmdline /proc/8/cmdline /proc/8/cmdline /proc/11/cmdline /proc/11/cmdline /proc/287/fd /proc/287/fd /proc/270/fd /proc/270/fd -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes:
description ioc /tmp/data/cowrie/downloads/a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3 /tmp/data/cowrie/downloads/a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3 /tmp/ftpupdate.sh /tmp/ftpupdate.sh /tmp/ftpupload.sh /tmp/ftpupload.sh
Processes
-
/tmp/data/cowrie/downloads/a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3/tmp/data/cowrie/downloads/a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de31⤵
- Reads system routing table
- Reads system network configuration
-
/bin/sh/bin/sh -c "iptables -A INPUT -p tcp --destination-port 23 -j DROP"1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 23 -j DROP2⤵
-
/bin/sh/bin/sh -c "iptables -A INPUT -p tcp --destination-port 7547 -j DROP"1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 7547 -j DROP2⤵
-
/bin/sh/bin/sh -c "iptables -A INPUT -p tcp --destination-port 5555 -j DROP"1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 5555 -j DROP2⤵
-
/bin/sh/bin/sh -c "iptables -A INPUT -p tcp --destination-port 5358 -j DROP"1⤵
-
/sbin/iptablesiptables -A INPUT -p tcp --destination-port 5358 -j DROP2⤵
-
/bin/sh/bin/sh -c "iptables -D INPUT -j CWMP_CR"1⤵
-
/sbin/iptablesiptables -D INPUT -j CWMP_CR2⤵
-
/bin/sh/bin/sh -c "iptables -X CWMP_CR"1⤵
-
/sbin/iptablesiptables -X CWMP_CR2⤵
-
/bin/sh/bin/sh -c "iptables -I INPUT -p udp --dport 5302 -j ACCEPT"1⤵
-
/sbin/iptablesiptables -I INPUT -p udp --dport 5302 -j ACCEPT2⤵