8533b4606bc1c049de0b20c63f25c3fb2237ad29c061112c6ffc2efb733c3111

Analysis

max time kernel
38913s
max time network
151s
platform
linux_mips
resource
debian9-mipsbe-en-20211208
resource tags

arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
04/03/2023, 02:28

Target

SecuriteInfo.com.Linux.Siggen.9999.32607.593.elf
Size

29KB
MD5

f1422210a1d020e9a2bad6e0436f5b03
SHA1

c5d3148863c0c8791b2656c630a028c47212a976
SHA256

8533b4606bc1c049de0b20c63f25c3fb2237ad29c061112c6ffc2efb733c3111
SHA512

54aa98d2e3716999e2d7be1cdb24df8f60dc890b970b8412dc5644dbd0172479e7d6286d31aa7a4096b62b7f150d1e56e924874663a786de5a10f7306d06df2a
SSDEEP

768:fauqnAxWZW/Uvxy9HrXrbSCZ+ssxLj6DrEu+OefTlzFVfgUYwJgGlzDpbuR1Jq:fauqnPW/Uvk3bSCZ+LJ+DAu+fTJFdr//

Score

9^/10

discovery

Contacts a large (20198) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

/tmp/SecuriteInfo.com.Linux.Siggen.9999.32607.593.elf
/tmp/SecuriteInfo.com.Linux.Siggen.9999.32607.593.elf
1⤵
PID:320

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact