Analysis
-
max time kernel
10s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
-
submitted
19/12/2023, 23:13
General
-
Target
507b51b74830fb1997d8feba7d59bacc
-
Size
23KB
-
MD5
507b51b74830fb1997d8feba7d59bacc
-
SHA1
a5ff1f1f59f99f0c42c5ce7841b15b6bfc0f1018
-
SHA256
c4a4e606eb091b6f69e162a73ab4727476cf22d0e2820c10a631ae54ca88e9e9
-
SHA512
cfde1830aea90bbd51ccaca204e282e41aaa47dea14901f040a45b234191cf23c519af57192f2e89687778e3e1975fa35f60dfb04aaef525daf13f7c766a0b88
-
SSDEEP
384:NLFLBF02VS/oAZnd708PxBC+5KCmFGptCCpmCz8EttIiW43TVh8LucB1V3y5EkXm:ljchndQorCQxuYRcutYIVh8CgJbkX750
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
KAIZEN
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/507b51b74830fb1997d8feba7d59bacc/tmp/507b51b74830fb1997d8feba7d59bacc1⤵
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information