Analysis
-
max time kernel
125s -
max time network
154s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20231215-en -
resource tags
-
submitted
19/12/2023, 23:03
General
-
Target
417a0aaf8e24d2fb2beb1d78601926c9
-
Size
89KB
-
MD5
417a0aaf8e24d2fb2beb1d78601926c9
-
SHA1
329fd324792032b09b780756899957306873595b
-
SHA256
331ed660c89c86ce4c15135f319f4bd434a6cf785a37b052e223e15531cb6726
-
SHA512
f15db61d0a61b91be0066d227e20fca3f976dfdb0520053c069d4601e104613b12e8e356ac2861be2fe5d01b85b1b2b9444100dc955ae4460668b0a74868387a
-
SSDEEP
1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZqgi:qCYxrKDy46Nh
Malware Config
Signatures
-
Contacts a large (16890) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 44 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/417a0aaf8e24d2fb2beb1d78601926c9/tmp/417a0aaf8e24d2fb2beb1d78601926c91⤵