Overview

overview

10

Static

static

10

ea90699a0a...e6.elf

debian-9-mips

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea90699a0a702614fd8f533961a45c1c3d1c0ea1da96ccbba4ea745e640bebe6.zip

  • Size

    50KB

  • Sample

    230321-r1v34sdd4z

  • MD5

    aefd485784b5d377606780710706218d

  • SHA1

    9ef5177d53eb8b84db0592c36dc43e00c0cc5107

  • SHA256

    b5ce21dffe40a9bacfc9fbc82ab956d523dd72636c354af31354f034467563ff

  • SHA512

    cb8b263bfc8f0a70ba0db2e4b5026fb601f4f04551bb8c51f390c55c09ae9a41eeea98d9267078094caaefb7bf5e9bb14151016ddbab49258a196b7d071a8a48

  • SSDEEP

    768:+0TPTcAsTtvqu0nYHd6iQXTzQx9VwgH6p+t08H+VH9vr+rpKHVEeTiakfi+00lf6:boXCjnYIisTo/jHKIHIxrQeQiaN6

Score
10/10
gafgyt

Malware Config

Targets

    • Target

      ea90699a0a702614fd8f533961a45c1c3d1c0ea1da96ccbba4ea745e640bebe6.elf

    • Size

      151KB

    • MD5

      723da50f4df1235c3669184fa5e26330

    • SHA1

      78a2a2bca0c788adf0cf2dc9e69e5b841d3675be

    • SHA256

      ea90699a0a702614fd8f533961a45c1c3d1c0ea1da96ccbba4ea745e640bebe6

    • SHA512

      f6e03b47d5d2b09883298fabbc008f1c43a29b3ccd8a7dc2095d23b492af6efe6228f1e7d334962141910fa83c0d87dc685b79a4132377c88930963f1d287b9e

    • SSDEEP

      3072:nWhzYxYCS1bxmjwLkqkmksQnGXmrThPaLEnvPrNb:WhUe4uk9GXmrThPaLEnvPrNb

    Score
    9/10

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

System Network Configuration Discovery

2
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks