Overview

overview

10

Static

static

10

1f9a29eb59...c29511

debian-9-armhf

9

Analysis

  • max time kernel
    152s
  • max time network
    156s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20231215-en
  • resource tags

    arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    19/12/2023, 22:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    1f9a29eb594e3bbb708b849c8ac29511

  • Size

    74KB

  • MD5

    1f9a29eb594e3bbb708b849c8ac29511

  • SHA1

    767974d8278acd7ba49d2f207200c9203f22e505

  • SHA256

    f794d5a0e144cab03850a9eee99b99f83d5b22c39bdb87a6dd02e98a932a0e5c

  • SHA512

    716eaccd61b9976777356c2c58744b635d6bf8218888c56a212638847b2ab41356c62b371b61300c075fda3665fda1744b3a6bd2c07d64ff51e397d92bedf401

  • SSDEEP

    1536:usO1+BkQ8yi6dT9ncsnxLs9ewNJ4HtGKu/NsAqXLH1iNODui9VAU1vz:usO1akQLY/yz7ViNi/pz

Score
9/10
discovery

Malware Config

Signatures

  • Contacts a large (23507) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads runtime system information 31 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/1f9a29eb594e3bbb708b849c8ac29511
    /tmp/1f9a29eb594e3bbb708b849c8ac29511
    1⤵
    • Modifies Watchdog functionality
    PID:670

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads