General
-
Target
4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7
-
Size
129KB
-
Sample
230131-r25c6saf4v
-
MD5
d3ce7e4fcbccaf0eae4a2647d6ee5615
-
SHA1
121baa5a4e369d2775b8ded189428d15b38f3f0c
-
SHA256
70d8556b4055c8978185a1a573678567036f387fa8eab55d126f48935d30a7c3
-
SHA512
ae81cbea890ca1710283d876535603457f342d54dd35a87cb826934c27ac973f6f3b60ccdb7abe1b54fb1042787434180dcf6b2adb436703380ac9020f7c8877
-
SSDEEP
3072:jSx/0SYVWKgZe9tZEehI8/8sYBboQASNyF:+x/0hwbs93hv/NYBFNyF
Static task
static1
Behavioral task
behavioral1
Sample
4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7
Resource
debian9-mipsbe-en-20211208
Malware Config
Targets
-
-
Target
4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7
-
Size
132KB
-
MD5
59ce0baba11893f90527fc951ac69912
-
SHA1
5857a7dd621c4c3ebb0b5a3bec915d409f70d39f
-
SHA256
4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7
-
SHA512
c5b12797b477e5e5964a78766bb40b1c0d9fdfb8eef1f9aee3df451e3441a40c61d325bf400ba51048811b68e1c70a95f15e4166b7a65a4eca0c624864328647
-
SSDEEP
3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioP:p3lOYoaja8xzx/0wsxzSi2
Score9/10-
Modifies the Watchdog daemon
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder
-
Modifies hosts file
Adds to hosts file used for mapping hosts to IP addresses.
-
Writes DNS configuration
Writes data to DNS resolver config file.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system routing table
Gets active network interfaces from /proc virtual filesystem.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads system network configuration
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory
Malware often drops required files in the /tmp directory.
-