Analysis
-
max time kernel
148s -
max time network
149s -
platform
debian-9_armhf -
resource
debian9-armhf-20231222-en -
resource tags
arch:armhfimage:debian9-armhf-20231222-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
30/12/2023, 04:27
General
-
Target
0e71c5e7f7a64093ec313c0e4faf044b
-
Size
45KB
-
MD5
0e71c5e7f7a64093ec313c0e4faf044b
-
SHA1
e78440a77d43cffd7cd545e31e3a1049308de1b5
-
SHA256
107e0ba2bf4f976bf489d90631ed80a4a9fa6897b2cc5e728130e0747e9cbd43
-
SHA512
3aa0bfc4a4e8fcab9327a753d466d831cdbbea1fbbfb113739e3fd22cd10e0eee38bc2a05615bcb09c048bc9138aa91d2a29fd46dbf6335edc3aedcc0b562787
-
SSDEEP
768:0Hq8XdG1zv6dgQqzo/8r0Ak6DOXz9nDK1rNS9q3UELbyBZRUpjx6+KNn2Ca7:0Hq8XdKziiQL/8HKXND6NHLbSUpk5c
Malware Config
Extracted
Family
mirai
Botnet
UNST
Signatures
-
Contacts a large (43665) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 2 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 0e71c5e7f7a64093ec313c0e4faf044b File opened for reading /proc/net/tcp Process not Found -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 0e71c5e7f7a64093ec313c0e4faf044b File opened for reading /proc/net/tcp Process not Found -
Reads runtime system information 50 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/767/exe Process not Found File opened for reading /proc/771/exe Process not Found File opened for reading /proc/626/fd Process not Found File opened for reading /proc/777/exe Process not Found File opened for reading /proc/703/exe Process not Found File opened for reading /proc/self/exe 0e71c5e7f7a64093ec313c0e4faf044b File opened for reading /proc/169/fd Process not Found File opened for reading /proc/576/fd Process not Found File opened for reading /proc/781/exe Process not Found File opened for reading /proc/295/fd Process not Found File opened for reading /proc/570/fd Process not Found File opened for reading /proc/637/exe Process not Found File opened for reading /proc/279/fd Process not Found File opened for reading /proc/297/fd Process not Found File opened for reading /proc/756/exe Process not Found File opened for reading /proc/666/fd Process not Found File opened for reading /proc/573/fd Process not Found File opened for reading /proc/632/exe Process not Found File opened for reading /proc/765/exe Process not Found File opened for reading /proc/573/exe Process not Found File opened for reading /proc/769/exe Process not Found File opened for reading /proc/775/exe Process not Found File opened for reading /proc/199/fd Process not Found File opened for reading /proc/258/fd Process not Found File opened for reading /proc/575/fd Process not Found File opened for reading /proc/658/exe Process not Found File opened for reading /proc/632/fd Process not Found File opened for reading /proc/634/exe Process not Found File opened for reading /proc/779/exe Process not Found File opened for reading /proc/673/exe Process not Found File opened for reading /proc/763/exe Process not Found File opened for reading /proc/773/exe Process not Found File opened for reading /proc/658/fd Process not Found File opened for reading /proc/262/fd Process not Found File opened for reading /proc/305/fd Process not Found File opened for reading /proc/641/fd Process not Found File opened for reading /proc/590/fd Process not Found File opened for reading /proc/575/exe Process not Found File opened for reading /proc/576/exe Process not Found File opened for reading /proc/590/exe Process not Found File opened for reading /proc/264/fd Process not Found File opened for reading /proc/638/exe Process not Found File opened for reading /proc/1/fd Process not Found File opened for reading /proc/309/fd Process not Found File opened for reading /proc/680/exe Process not Found File opened for reading /proc/570/exe Process not Found File opened for reading /proc/761/exe Process not Found File opened for reading /proc/134/fd Process not Found File opened for reading /proc/261/fd Process not Found File opened for reading /proc/633/fd Process not Found