Overview

overview

10

Static

static

7

SecuriteIn...59.elf

debian-9-mips

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20221111-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20221111-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    30-04-2023 03:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Linux.Siggen.9999.11120.22659.elf

  • Size

    29KB

  • MD5

    35379ab8e8ebaa656db7575d1f9eb976

  • SHA1

    1ccc7718504aaa19c0663222ebdc60f67be1f29e

  • SHA256

    f4e48e33d6ba090c6b61ef9ca3460f244be8dc3d36c55e0d83916925f5e00724

  • SHA512

    f0c903a661a403501b91aa1ca6e76c2cca01778a361c60eb3421eda4ef45b5337a0667f3780a4dd3e604382ac14bfec8bc3215273bf5846d4e9e6e79241ef70d

  • SSDEEP

    768:cNwtIOp5dCdu+wqxMl2CdTP4L5lcTCiVcJgGlzDpbuR1Jp:cNwtN/qu+txMlNTMTcTCi6VJuf

Score
10/10
miraiunstbotnetdiscovery

Malware Config

Extracted

Family

mirai

Botnet

UNST

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Contacts a large (65267) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Modifies the Watchdog daemon 1 TTPs

    Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets 1 TTPs 2 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 25 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/SecuriteInfo.com.Linux.Siggen.9999.11120.22659.elf
    /tmp/SecuriteInfo.com.Linux.Siggen.9999.11120.22659.elf
    1⤵
    • Enumerates active TCP sockets
    • Reads system network configuration
    PID:327

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/327-1-0x00400000-0x00457c88-memory.dmp
    Download