Analysis
-
max time kernel
151s -
max time network
154s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20231215-en -
resource tags
-
submitted
19-12-2023 22:25
General
-
Target
07ae2774caf546358cde3b9751dac02f
-
Size
89KB
-
MD5
07ae2774caf546358cde3b9751dac02f
-
SHA1
2dee08f7812fe7c8d4d1ba121a635e7344a5af9c
-
SHA256
8b33823366ce20a7246f967e542555b976e1c966d414aa71785d08b1f2cb3572
-
SHA512
6a8e20b24345c184a91f1d1df93d4c679a3cf2bdee2cec170ca1e99cc61cf87f8690ecf355adb2017ce1b3a553d95d7bdce38e26e19d0a8b68b7c1194d70fdf0
-
SSDEEP
1536:NYCYxrXP40ODJPwHRQ9PlzTRfyToNoZqKi:qCYxrKDJ46N7
Malware Config
Signatures
-
Contacts a large (20212) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 28 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/07ae2774caf546358cde3b9751dac02f/tmp/07ae2774caf546358cde3b9751dac02f1⤵