Analysis
-
max time kernel
125s -
max time network
149s -
platform
debian-9_mips -
resource
debian9-mipsbe-20231215-en -
resource tags
arch:mipsimage:debian9-mipsbe-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
19-12-2023 22:41
Behavioral task
behavioral1
Sample
1ebdbe21b35f5bb1291773961dbabdfd
Resource
debian9-mipsbe-20231215-en
debian-9-mips
General
-
Target
1ebdbe21b35f5bb1291773961dbabdfd
-
Size
93KB
-
MD5
1ebdbe21b35f5bb1291773961dbabdfd
-
SHA1
78fa89f8377be1a2d0f03810f9dbe069b1a5338b
-
SHA256
38afb5ddaec4ece8409e6f83e1156e04e4237dce90be988f6ce4c7c1f8be8279
-
SHA512
fe57b374239a501e5c6c2e53ee5d3375ffc0e540c4eaee19b58b6b4f2aa17119b700f91535522f578ff247bba10b87af84f0e4fdf71030415cc06f44bd2d00e1
-
SSDEEP
1536:vrHvYp48JxAGhXG5SbPvFYdX2tUv+Piwl6+dwqe7AZWmlQy5HKKPXRNKQHRsMJPp:7vB8JxA0XRMqe7UWmlQaKKPXRNKQxsMn
Malware Config
Signatures
-
Contacts a large (16649) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/374/fd File opened for reading /proc/1078/exe File opened for reading /proc/1122/exe File opened for reading /proc/619/exe File opened for reading /proc/674/exe File opened for reading /proc/740/exe File opened for reading /proc/803/exe File opened for reading /proc/744/exe File opened for reading /proc/793/exe File opened for reading /proc/877/exe File opened for reading /proc/964/exe File opened for reading /proc/1026/exe File opened for reading /proc/1099/exe File opened for reading /proc/355/fd File opened for reading /proc/356/fd File opened for reading /proc/857/exe File opened for reading /proc/996/exe File opened for reading /proc/1003/exe File opened for reading /proc/354/fd File opened for reading /proc/688/fd File opened for reading /proc/709/fd File opened for reading /proc/688/exe File opened for reading /proc/902/exe File opened for reading /proc/1103/exe File opened for reading /proc/710/fd File opened for reading /proc/865/exe File opened for reading /proc/935/exe File opened for reading /proc/943/exe File opened for reading /proc/402/fd File opened for reading /proc/888/exe File opened for reading /proc/1030/exe File opened for reading /proc/358/fd File opened for reading /proc/619/fd File opened for reading /proc/689/exe File opened for reading /proc/849/exe File opened for reading /proc/1038/exe File opened for reading /proc/876/exe File opened for reading /proc/689/fd File opened for reading /proc/700/fd File opened for reading /proc/715/fd File opened for reading /proc/868/exe File opened for reading /proc/892/exe File opened for reading /proc/991/exe File opened for reading /proc/657/fd File opened for reading /proc/674/fd File opened for reading /proc/714/fd File opened for reading /proc/656/exe File opened for reading /proc/1060/exe File opened for reading /proc/697/exe File opened for reading /proc/944/exe File opened for reading /proc/1088/exe File opened for reading /proc/1131/exe File opened for reading /proc/1152/exe File opened for reading /proc/692/exe File opened for reading /proc/739/exe File opened for reading /proc/798/exe File opened for reading /proc/1068/exe File opened for reading /proc/1/fd File opened for reading /proc/775/exe File opened for reading /proc/1155/exe File opened for reading /proc/241/fd File opened for reading /proc/693/exe File opened for reading /proc/1145/exe File opened for reading /proc/634/exe