Analysis
-
max time kernel
151s -
max time network
155s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20231215-en -
resource tags
-
submitted
19/12/2023, 23:18
General
-
Target
57fc60fdd3aba28673f1cfbe726fb9f3
-
Size
31KB
-
MD5
57fc60fdd3aba28673f1cfbe726fb9f3
-
SHA1
4b142f7f3b628845ad20c14c9151f1f83c23d00a
-
SHA256
4147eca0c4e57b8d57b64cea7f2aaa44d0669c4c12b6073124e450b349dec08f
-
SHA512
676936d6f722cb8894f32fb47cf9b29ff2a185132c7ba9bb3b34837f2b294c438135319284265b0620bb3e2b2508013529fff346ea801ca541465c11fd1835dd
-
SSDEEP
768:vfpWce1ZA4R4v+ucqq+YTgLAiePbva3rWB:vfkcs/R4xcqqhTa38
Malware Config
Extracted
mirai
UNST
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (20361) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 33 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/57fc60fdd3aba28673f1cfbe726fb9f3/tmp/57fc60fdd3aba28673f1cfbe726fb9f31⤵