Analysis
-
max time kernel
151s -
max time network
154s -
platform
debian-9_armhf -
resource
debian9-armhf-20230831-en -
resource tags
-
submitted
04-10-2023 18:51
General
-
Target
arm7.elf
-
Size
61KB
-
MD5
4c729108aed369e34f23591228faae82
-
SHA1
65faa5ee4b29e9186034b92065fc6747c4227d05
-
SHA256
74b749787b1ab4cdd9073925ed2ce4af999f1e05fa704274a05923236b8de917
-
SHA512
68dc4001294e8d8d631f92687d2ed87f7d067167aaeb5fb21019bcc8733df561eda86e2443816742022df9f07ffd7896363e5a8a58be3b970015fee137c52303
-
SSDEEP
1536:BeIqfnocUDwSSrDez+0qFRio2hAjkWnPX0CyGF:BeIen5UD3owqFJ22RnPkCyGF
Malware Config
Extracted
mirai
KYTON
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (91213) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Writes file to system bin folder 1 TTPs 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/arm7.elf/tmp/arm7.elf1⤵
- Changes its process name
- Reads runtime system information