Analysis
-
max time kernel
151s -
max time network
159s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
resource tags
-
submitted
02-05-2023 01:50
General
-
Target
00d9fe0a6bb4c16c51af172afcd42df3da3ac918af723d4c89465c80b74824e5.elf
-
Size
68KB
-
MD5
98520685bcb57b1e7c903aa5b64e2d97
-
SHA1
6c7e69c20c02e498acd803863207646ef965a1fa
-
SHA256
00d9fe0a6bb4c16c51af172afcd42df3da3ac918af723d4c89465c80b74824e5
-
SHA512
396d9badc38762fe160985ea5e7b27e1ec4891eb20db321e28892eba46bc0491bf7b91b732566649fc435a7380b6bfb208ac6e027e0b5cb8249855c8d3cb2a63
-
SSDEEP
1536:bmuRtG/R7HiIb+wkqER7/kpevPyJTD/Lh1mhIJXXwi1zqP:blw/sIWPt/+eva5bLh1mCJXX/hO
Malware Config
Extracted
mirai
KYTON
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (81808) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 1 IoCs
-
Changes its process name 1 IoCs
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/00d9fe0a6bb4c16c51af172afcd42df3da3ac918af723d4c89465c80b74824e5.elf/tmp/00d9fe0a6bb4c16c51af172afcd42df3da3ac918af723d4c89465c80b74824e5.elf1⤵
- Changes its process name
- Reads runtime system information