Analysis
-
max time kernel
3s -
platform
debian-9_mips -
resource
debian9-mipsbe-20231215-en -
resource tags
-
submitted
19-12-2023 23:11
General
-
Target
4dde761681684d7edad4e5e1ffdb940b
-
Size
106KB
-
MD5
4dde761681684d7edad4e5e1ffdb940b
-
SHA1
2327be693bc11a618c380d7d3abc2382d870d48b
-
SHA256
d546509ab6670f9ff31783ed72875dfc0f37fa2b666bd5870eecaaed2ebea4a8
-
SHA512
91a61c719128f263f9f95736d55895954cc468c74ff469ee061d35ec382c50b9165e9a5427dc46a835dac6ae0e6e1f9819632475f68b98a907b53196bd4eb02a
-
SSDEEP
1536:3aQiZDMyqIlMBZ/R0F4E4kcHiNq98wk9njKZjjLuYo68864sNHFEzv7Ld76divkE:KzDMyqIMBZ/R0ufhBmgZy9yNsNmPtcE
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Writes file to system bin folder 1 TTPs 2 IoCs
-
Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/4dde761681684d7edad4e5e1ffdb940b/tmp/4dde761681684d7edad4e5e1ffdb940b1⤵
-
/bin/shsh -c "iptables -I INPUT -p tcp --destination-port 22 -j DROP"1⤵
-
/sbin/iptablesiptables -I INPUT -p tcp --destination-port 22 -j DROP2⤵
-