Analysis
-
max time kernel
98s -
max time network
150s -
platform
debian-9_mips -
resource
debian9-mipsbe-20221111-en -
resource tags
-
submitted
31-05-2023 01:25
General
-
Target
d11d572a1404d32ffc062ad741c29588ccd4af2da03aafa8081d059119e2bfd7.elf
-
Size
31KB
-
MD5
687be0db64e721cafa547f1717c5e7d1
-
SHA1
c817451dc6d72adfe602330fa333058db45d7963
-
SHA256
d11d572a1404d32ffc062ad741c29588ccd4af2da03aafa8081d059119e2bfd7
-
SHA512
f1504959e986f1b751776a81115fb214788b673b4bb9d4f80cb6826795a43e3077df74e1404dc85e16725b8fc17fe50856b25b5d887bd3718304edd23de748d5
-
SSDEEP
768:JgmeI3ZV7A/9k9mPf+JOcEXVigSwPPnNOoslXh1YSU6DCJgGlzDpUYsyU:Jn3H0/W90fMFai+k/VGVqYZU
Malware Config
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (167468) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Deletes itself 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/d11d572a1404d32ffc062ad741c29588ccd4af2da03aafa8081d059119e2bfd7.elf/tmp/d11d572a1404d32ffc062ad741c29588ccd4af2da03aafa8081d059119e2bfd7.elf1⤵
- Changes its process name
- Deletes itself
- Reads runtime system information