3435fc10f8fe034166c954a9b8a39e24bdfa2dec6d21e08dd2cf5be232a47899 | Triage

Sharing

General

Target

3435fc10f8fe034166c954a9b8a39e24bdfa2dec6d21e08dd2cf5be232a47899
Size

48KB
Sample

221125-kp2ceshh6t
MD5

886f05591c197c28accea96d35e7e0d5
SHA1

2a9bdf49cd2e807ebdf014ede8a7cc3e65110ebb
SHA256

3435fc10f8fe034166c954a9b8a39e24bdfa2dec6d21e08dd2cf5be232a47899
SHA512

c37b2b976b36314a5492efa1140c9db100cf5d6848b8775223d13d0723c72cbe05dad263e153ce32be13393735872c06e83198ba889afc31c3d9934d091a358d
SSDEEP

768:CC/vVNNIgETs7EL7yqjrZEp6evOTVEt1dwXUBnu8IdjBVCQtggqMpWRh:CsVIgooE/1jWptWT2tjHIdHC2gJM0

Score

9^/10

Malware Config

Targets

- Target
  
  3435fc10f8fe034166c954a9b8a39e24bdfa2dec6d21e08dd2cf5be232a47899
- Size
  
  48KB
- MD5
  
  886f05591c197c28accea96d35e7e0d5
- SHA1
  
  2a9bdf49cd2e807ebdf014ede8a7cc3e65110ebb
- SHA256
  
  3435fc10f8fe034166c954a9b8a39e24bdfa2dec6d21e08dd2cf5be232a47899
- SHA512
  
  c37b2b976b36314a5492efa1140c9db100cf5d6848b8775223d13d0723c72cbe05dad263e153ce32be13393735872c06e83198ba889afc31c3d9934d091a358d
- SSDEEP
  
  768:CC/vVNNIgETs7EL7yqjrZEp6evOTVEt1dwXUBnu8IdjBVCQtggqMpWRh:CsVIgooE/1jWptWT2tjHIdHC2gJM0
Score

9^/10
- Modifies the Watchdog daemon
  Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
- Reads runtime system information
  Reads data from /proc virtual filesystem.
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Impair Defenses

Credential Access

Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1