Analysis
-
max time kernel
153s -
max time network
154s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04-05-2023 08:01
General
-
Target
xd.x86.elf
-
Size
29KB
-
MD5
3ac9feb7bc5dd1acdd2f444a9f6874b6
-
SHA1
554c03942552e6de81fd0e5b264e7e30b7076317
-
SHA256
1213cfaac8894eb28d63fc974cd61396c6bf017a1aa642b5e275c2ef4dd098c3
-
SHA512
6f7010a0ab12f371c25e39c772d9c78136d6a112190bf893906005f8db59b4dc07a0cd1f67eb8d955b1f09c5821305af8d6177fa37450fb2c067468dbced9546
-
SSDEEP
384:MpGclfUDwDsOAFImUQSAAHCj9TKcSLJY7eoayfsqxRFpDU7/2LDVokNyqN:PcmROmIIAiNKpLJY7Pa6tpI7/SoB4
Malware Config
Extracted
mirai
LZRD
Signatures
-
Contacts a large (20206) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/net/tcp -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
description ioc File opened for reading /proc/net/tcp -
Reads runtime system information 36 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/586/fd File opened for reading /proc/575/exe File opened for reading /proc/578/exe File opened for reading /proc/418/fd File opened for reading /proc/447/fd File opened for reading /proc/332/fd File opened for reading /proc/581/fd File opened for reading /proc/588/exe File opened for reading /proc/223/fd File opened for reading /proc/251/fd File opened for reading /proc/584/exe File opened for reading /proc/416/exe File opened for reading /proc/339/fd File opened for reading /proc/356/fd File opened for reading /proc/583/fd File opened for reading /proc/576/exe File opened for reading /proc/577/exe File opened for reading /proc/286/fd File opened for reading /proc/369/fd File opened for reading /proc/347/fd File opened for reading /proc/352/fd File opened for reading /proc/363/fd File opened for reading /proc/416/fd File opened for reading /proc/575/fd File opened for reading /proc/420/exe File opened for reading /proc/1/fd File opened for reading /proc/252/fd File opened for reading /proc/447/exe File opened for reading /proc/592/exe File opened for reading /proc/584/fd File opened for reading /proc/418/exe File opened for reading /proc/458/exe File opened for reading /proc/333/fd File opened for reading /proc/341/fd File opened for reading /proc/289/fd File opened for reading /proc/458/fd
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/580-1-0x0000000008048000-0x0000000008058900-memory.dmp