Analysis
-
max time kernel
152s -
max time network
155s -
platform
debian-9_mips -
resource
debian9-mipsbe-20231215-en -
resource tags
-
submitted
19-12-2023 23:29
General
-
Target
69c14394c19b7826f59f12b43a8335af
-
Size
31KB
-
MD5
69c14394c19b7826f59f12b43a8335af
-
SHA1
1e0b4169fd8c3527467ca09446802efb92834e17
-
SHA256
5259ff86f2c6200aa64e4584cc6286c64ec289364bf9be39d304f37181a15ad7
-
SHA512
346e796fc2806ea4da887eadf94e5304b382dc46c5634069849b729aaac38a2017a4f8490b9f08198d932f2727bdb8e6eeb362d64b38333d5c487fb3af770c90
-
SSDEEP
768:vsX08KIcQN6jggSIBjhSpnnbYHJgGlzDpUYsy:vM0sh6NzHqYFVqYV
Malware Config
Extracted
mirai
UNSTABLE
0x.un5t48l3.host
darksoul.un5t48l3.host
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (79654) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/69c14394c19b7826f59f12b43a8335af/tmp/69c14394c19b7826f59f12b43a8335af1⤵
- Changes its process name
- Reads runtime system information