Analysis
-
max time kernel
153s -
max time network
158s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
20/12/2023, 11:18
General
-
Target
a97af67e89678ae9195e7ac9e39b25af
-
Size
29KB
-
MD5
a97af67e89678ae9195e7ac9e39b25af
-
SHA1
b30f4fed47d5e93e96ad05a8398da8a3b4ab7c8c
-
SHA256
5c207f50f97402b44042f8780ede2beabea08db3b870b76735afa8e2fd64c617
-
SHA512
fdedbf0918efd224c02458be169d873b91328dd1e68b244825e3fd1156f3ef65b44139fd59f8be00e7f259bbbc2d1daa61e6c2a3f19967b06cb60bc415fd7292
-
SSDEEP
768:C2v1lsdixHq7Wu2PDG4rFct/+VyRYWsrQYWtZZvOthZecKjb2tVKiI:Lv1lHuW/xrFyVRWQvZWzKjbGFI
Malware Config
Extracted
mirai
FLASH
j2hnet.duckdns.org
j2hnet2.duckdns.org
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (81643) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/a97af67e89678ae9195e7ac9e39b25af/tmp/a97af67e89678ae9195e7ac9e39b25af1⤵
- Changes its process name
- Reads runtime system information