Analysis
-
max time kernel
149s -
max time network
149s -
platform
debian-9_armhf -
resource
debian9-armhf-20240221-en -
resource tags
-
submitted
23/02/2024, 22:49
General
-
Target
a08a145f7af68295948995330b9755f4
-
Size
70KB
-
MD5
a08a145f7af68295948995330b9755f4
-
SHA1
a68fdab10033f42c76dab962f72756ca923206ca
-
SHA256
a4ae8660624f24a3f6bf099ebb26b03b8ac29eb911877f28d78b8c0c317be6c5
-
SHA512
5d052ba9011aea0e313877e394d975bc26a08199d34c0720f5140b74e8d50a62da4bba9d6995cfee790a34a660309fff5111c76a896cec0929358f007c8c2a3e
-
SSDEEP
1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V83HxouJeZWDFI8VM:GbtexU0r83CKw2FbS
Malware Config
Signatures
-
Contacts a large (20370) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 48 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/a08a145f7af68295948995330b9755f4/tmp/a08a145f7af68295948995330b9755f41⤵