Analysis
-
max time kernel
151s -
max time network
154s -
platform
debian-9_mips -
resource
debian9-mipsbe-20231215-en -
resource tags
-
submitted
19/12/2023, 23:19
General
-
Target
5a4bcfab1606b93dfecc768b9ab4c9dd
-
Size
29KB
-
MD5
5a4bcfab1606b93dfecc768b9ab4c9dd
-
SHA1
1e2792a616d7a6b14bbaa05d6f7dd93ac00012ce
-
SHA256
d7098fbe3549d9a394d1ea2d4fd1486a79cb68b41dd8a2a75cec79aa797f9011
-
SHA512
5e398d638c26bc12b532c8cfe77e7625d1860ade9ba945e33f286bbad63fa98edae86bf6449de49a261164545e67f3b0f6d1fb23e2126628cf8f11ff209be99b
-
SSDEEP
768:JHbKO/gkgnb5i/n1EbuA8+4iejlMPnnJOrZGKyXMsOIjJgGlzDpbuR1J8:EOjgnb5i/nqbudwnJcQcsXZVJuW
Malware Config
Extracted
mirai
MIRAI
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (16686) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/5a4bcfab1606b93dfecc768b9ab4c9dd/tmp/5a4bcfab1606b93dfecc768b9ab4c9dd1⤵