Analysis
-
max time kernel
154s -
max time network
154s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04-05-2023 15:13
General
-
Target
1374d35d5467d1d731eec8c5264b29c3.elf
-
Size
33KB
-
MD5
1374d35d5467d1d731eec8c5264b29c3
-
SHA1
92d8e0fb0075b7bdc83a3bf0f4963dd27812b408
-
SHA256
46cb41f8508a27f2cbb629fede3c3c2064a0f50403919c9cf9d201cc0525d656
-
SHA512
014ab12486b02eb488018c1f60226827c4c28f7ec5c12bbe42ae73a9bc6a5be1c6255836b368d80400d0284e6af015d7825c2da4a847fbca5eee1bc4b649fe26
-
SSDEEP
768:NYuXQRH6lLCbVWLC51vC+X2F+KpONF64j4wK4V77aHnbcuyD7Uiyqd:NXXwuLCbVW+PvDX2F+akPj4uqHnouy8A
Malware Config
Extracted
mirai
UNSTABLE
ensurex.riches.homes
Signatures
-
Contacts a large (180870) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Changes its process name 1 IoCs
Processes:
1374d35d5467d1d731eec8c5264b29c3.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself a 597 1374d35d5467d1d731eec8c5264b29c3.elf -
Reads runtime system information 17 IoCs
Reads data from /proc virtual filesystem.
Processes:
1374d35d5467d1d731eec8c5264b29c3.elfdescription ioc File opened for reading /proc/565/cmdline File opened for reading /proc/594/cmdline File opened for reading /proc/600/cmdline File opened for reading /proc/602/cmdline File opened for reading /proc/684/cmdline File opened for reading /proc/409/cmdline File opened for reading /proc/422/cmdline File opened for reading /proc/460/cmdline File opened for reading /proc/self/exe 1374d35d5467d1d731eec8c5264b29c3.elf File opened for reading /proc/601/cmdline File opened for reading /proc/603/cmdline File opened for reading /proc/595/cmdline File opened for reading /proc/688/cmdline File opened for reading /proc/696/cmdline File opened for reading /proc/424/cmdline File opened for reading /proc/592/cmdline File opened for reading /proc/593/cmdline
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/597-1-0x0000000008048000-0x000000000805bfa0-memory.dmp