Analysis
-
max time kernel
11804s -
max time network
150s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20221111-en -
resource tags
arch:mipselimage:debian9-mipsel-20221111-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
28-03-2023 08:51
Behavioral task
behavioral1
Sample
ca3ba58cdcb0ee75a6f00f70f6ab6d27.elf
Resource
debian9-mipsel-20221111-en
debian-9-mipsel
General
-
Target
ca3ba58cdcb0ee75a6f00f70f6ab6d27.elf
-
Size
55KB
-
MD5
ca3ba58cdcb0ee75a6f00f70f6ab6d27
-
SHA1
9ab545a9a76e42f92342dcbf6400d06832379320
-
SHA256
3ec548d511742813215c3015b4c5cc73ad10593886f5bdc9b78650f3fe2faa1f
-
SHA512
170b83d7036b27af3950730c6a41c994148fdef7cc2d448fd86d8486d7f385869beae555316a82c94dca1e848d4a7ec8aa8609e44ddd5b256efe84b281f82427
-
SSDEEP
768:gH2Dn/oCOZejsoYCfmczbttLKk9rm55qaetMeOLe8NVvikXXiXRpg4DAV:gWD/oCuSfAyW1oMXLPNVvJb4U
Malware Config
Signatures
-
Contacts a large (69933) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc /proc/77/cmdline /proc/77/cmdline /proc/142/cmdline /proc/142/cmdline /proc/148/cmdline /proc/148/cmdline /proc/10/cmdline /proc/10/cmdline /proc/24/cmdline /proc/24/cmdline /proc/19/cmdline /proc/19/cmdline /proc/217/cmdline /proc/217/cmdline /proc/69/cmdline /proc/69/cmdline /proc/70/cmdline /proc/70/cmdline /proc/247/cmdline /proc/247/cmdline /proc/248/cmdline /proc/248/cmdline /proc/5/cmdline /proc/5/cmdline /proc/6/cmdline /proc/6/cmdline /proc/323/cmdline /proc/323/cmdline /proc/338/cmdline /proc/338/cmdline /proc/9/cmdline /proc/9/cmdline /proc/293/cmdline /proc/293/cmdline /proc/18/cmdline /proc/18/cmdline /proc/393/cmdline /proc/393/cmdline /proc/37/cmdline /proc/37/cmdline /proc/215/cmdline /proc/215/cmdline /proc/294/cmdline /proc/294/cmdline /proc/328/cmdline /proc/328/cmdline /proc/23/cmdline /proc/23/cmdline /proc/36/cmdline /proc/36/cmdline /proc/206/cmdline /proc/206/cmdline /proc/275/cmdline /proc/275/cmdline /proc/20/cmdline /proc/20/cmdline /proc/73/cmdline /proc/73/cmdline /proc/286/cmdline /proc/286/cmdline /proc/389/cmdline /proc/389/cmdline /proc/75/cmdline /proc/75/cmdline /proc/252/cmdline /proc/252/cmdline /proc/7/cmdline /proc/7/cmdline /proc/159/cmdline /proc/159/cmdline /proc/ /proc/ /proc/3/cmdline /proc/3/cmdline /proc/83/cmdline /proc/83/cmdline /proc/12/cmdline /proc/12/cmdline /proc/76/cmdline /proc/76/cmdline /proc/216/cmdline /proc/216/cmdline /proc/219/cmdline /proc/219/cmdline /proc/334/cmdline /proc/334/cmdline /proc/2/cmdline /proc/2/cmdline /proc/4/cmdline /proc/4/cmdline /proc/106/cmdline /proc/106/cmdline /proc/117/cmdline /proc/117/cmdline /proc/227/cmdline /proc/227/cmdline /proc/329/cmdline /proc/329/cmdline /proc/17/cmdline /proc/17/cmdline /proc/72/cmdline /proc/72/cmdline /proc/14/cmdline /proc/14/cmdline /proc/22/cmdline /proc/22/cmdline /proc/82/cmdline /proc/82/cmdline /proc/11/cmdline /proc/11/cmdline /proc/13/cmdline /proc/13/cmdline /proc/78/cmdline /proc/78/cmdline /proc/116/cmdline /proc/116/cmdline /proc/1/cmdline /proc/1/cmdline /proc/15/cmdline /proc/15/cmdline /proc/21/cmdline /proc/21/cmdline /proc/71/cmdline /proc/71/cmdline /proc/81/cmdline /proc/81/cmdline /proc/280/cmdline /proc/280/cmdline