Analysis
-
max time kernel
148s -
max time network
147s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
-
submitted
12-02-2024 22:51
General
-
Target
97d02b9b6d544f50355ef7c453bd0534
-
Size
141KB
-
MD5
97d02b9b6d544f50355ef7c453bd0534
-
SHA1
a030139e2cfedf1a2bf1596ea5254b7e62482dd8
-
SHA256
8258437a0c14ebc15830ca96f79d0c2304cb8f1c58ffe1b0524dcbff9f541500
-
SHA512
4485588d542ce3bca0893f84c0c2e9d1f1f2c5289d927909216b0897aaeef9d447f628feb993ae5fd6d1dd3b5afab0bd78a298e501b5a8a160ae6d8e6bb6ebe9
-
SSDEEP
3072:EPq5ljYV6JIxedD4W/z+/O/04GGQ7LkWZE/vNO:bYsIxedDwO/04GGQ74WZE/vNO
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/97d02b9b6d544f50355ef7c453bd0534/tmp/97d02b9b6d544f50355ef7c453bd05341⤵
- Changes its process name
- Reads system routing table
- Reads system network configuration