Analysis
-
max time kernel
116s -
max time network
143s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20221111-en -
resource tags
-
submitted
31-05-2023 01:43
General
-
Target
4fb4e918a266f4ecc087f64f3d4ac04303f02ae5e57d49f037710c502ff07acf.elf
-
Size
32KB
-
MD5
9e32ed8c9403be4cf22c1dee53c7da0c
-
SHA1
91c086a6a71453600d1b3b894b4158a0377b6af1
-
SHA256
4fb4e918a266f4ecc087f64f3d4ac04303f02ae5e57d49f037710c502ff07acf
-
SHA512
6ca48b910cf61a2b97e60160fbdf60f0dc7152a461db1b2bd82dc6aaff076ecefbba507d5fa732fb690d05ca6482fddd0a590663887151941c2ff38faf0674d7
-
SSDEEP
768:GdI28u3wKNzyHtNc+9BT447b4AcAOjSSP624PSqgWMz3:qx8CNWH8eBTzaAaSSCCx3
Malware Config
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (195337) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Deletes itself 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/4fb4e918a266f4ecc087f64f3d4ac04303f02ae5e57d49f037710c502ff07acf.elf/tmp/4fb4e918a266f4ecc087f64f3d4ac04303f02ae5e57d49f037710c502ff07acf.elf1⤵
- Changes its process name
- Deletes itself
- Reads runtime system information