Analysis
-
max time kernel
148s -
max time network
146s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
-
submitted
20-12-2023 06:03
General
-
Target
8a1cfad9333a1d3355eaca87dd845ad3
-
Size
126KB
-
MD5
8a1cfad9333a1d3355eaca87dd845ad3
-
SHA1
6309ac93767d4044a82d6a55152c5371ac84eb6e
-
SHA256
142664246f0009ffa45d1ac9b8a2b7a23c0374f7e2b856d4e8713e613767f3d2
-
SHA512
e15f20b5d755cb1b207eb4e48e32d4b3d64b9a883175bc817bd91c7a189b73ffd61de919fb878998c7433772c3eb5105fa504eaaad95392aa8edeaabcc4484f6
-
SSDEEP
3072:6jVlyaL5JCrIpv04sSbttiEiTmP46aQyfPlfKsNb:yoCJCN4sSbHemP46aQyfPlfKsNb
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/8a1cfad9333a1d3355eaca87dd845ad3/tmp/8a1cfad9333a1d3355eaca87dd845ad31⤵
- Changes its process name
- Reads system routing table
- Reads system network configuration