Analysis
-
max time kernel
150s -
max time network
153s -
platform
linux_mipsel -
resource
debian9-mipsel-en-20211208 -
resource tags
-
submitted
09/07/2023, 11:02
General
-
Target
32610x004000000x00462fd0m.dmp
-
Size
138KB
-
MD5
cc06a72060cbc261c727962802973e3b
-
SHA1
4842f7a4cab5250006c88a6988fcf41f5a1c43e2
-
SHA256
9fa4e174e36ca57908fcfd848c3ec8ec466cd3b175ac13bc852e168c353a295f
-
SHA512
881034a645ea660ed672d20fe4278c655735703d0f3498f79ec101c7119e175e847ce72c5425be1f06ffd1f78ad8ae526716c893706bf77a9ef79e2b3b5a0a61
-
SSDEEP
1536:2F2WN9dpeL9xLMvWeNGSdtGH+8MIOwf+jUPORLNAGS7AdcxZEQiBTXBOu:HWN9dpeJxAWeNR58J5KvcxUxZ
Malware Config
Signatures
-
Contacts a large (20316) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 23 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/32610x004000000x00462fd0m.dmp/tmp/32610x004000000x00462fd0m.dmp1⤵