Analysis
-
max time kernel
151s -
max time network
154s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
resource tags
arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
04-05-2023 08:50
General
-
Target
da1dd85a4c0caad250e12ceb09a7ebec.elf
-
Size
52KB
-
MD5
da1dd85a4c0caad250e12ceb09a7ebec
-
SHA1
a42dd1975668a14540656802322b0b84a631865d
-
SHA256
7f295bcbb274edcdf9b6f927ca1bdb48ae7052d72d14563794c13073a811bfad
-
SHA512
3a354871f4e5cf83add2ba83357b7132afa8fa4e3e5ed0520acde1434a6547c3e512b4097f929a5b82812c36ff592eaa0970930450e99b64f6bf0b6e03220bab
-
SSDEEP
768:fPyuZr6HxkmEt3VY92uqUZlKOzzOTMoUH27J+nus9q3UELVVhRLRP5/JqpecU:Jq43VTU6OGg6+nu1LVVhRNRgpecU
Malware Config
Extracted
mirai
LZRD
Signatures
-
Contacts a large (19085) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/net/tcp -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
description ioc File opened for reading /proc/net/tcp -
Reads runtime system information 34 IoCs
Reads data from /proc virtual filesystem.
Processes:
da1dd85a4c0caad250e12ceb09a7ebec.elfdescription ioc File opened for reading /proc/320/fd File opened for reading /proc/404/exe File opened for reading /proc/412/exe File opened for reading /proc/208/fd File opened for reading /proc/235/fd File opened for reading /proc/278/fd File opened for reading /proc/269/fd File opened for reading /proc/373/fd File opened for reading /proc/self/exe da1dd85a4c0caad250e12ceb09a7ebec.elf File opened for reading /proc/161/fd File opened for reading /proc/236/fd File opened for reading /proc/362/fd File opened for reading /proc/368/fd File opened for reading /proc/377/fd File opened for reading /proc/371/exe File opened for reading /proc/406/exe File opened for reading /proc/408/exe File opened for reading /proc/410/exe File opened for reading /proc/238/fd File opened for reading /proc/323/fd File opened for reading /proc/361/fd File opened for reading /proc/370/fd File opened for reading /proc/401/exe File opened for reading /proc/402/exe File opened for reading /proc/270/fd File opened for reading /proc/287/fd File opened for reading /proc/374/fd File opened for reading /proc/1/fd File opened for reading /proc/322/fd File opened for reading /proc/403/exe File opened for reading /proc/139/fd File opened for reading /proc/226/fd File opened for reading /proc/316/fd File opened for reading /proc/371/fd
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/367-1-0x00008000-0x00029bc4-memory.dmp