Analysis
-
max time kernel
150s -
max time network
155s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
26-02-2024 08:08
General
-
Target
a5da1900a3eae7081b8d3597b7dc6d76
-
Size
31KB
-
MD5
a5da1900a3eae7081b8d3597b7dc6d76
-
SHA1
9ead127cf2c89c36fca872bd25e8882f8bbf3c05
-
SHA256
e2a6d5e68983635d01a85dd8e5539dc9bab7c0cc2fe47dbffd647b1ed2f72675
-
SHA512
beb8b8c976e2076080127125f435fadd15142313ace1c58841bb84c69a87bf08e9a10ea9f2be488d88aa23c0790c4a23dca967688a5fa86ba7590dfed7b243ca
-
SSDEEP
768:hha+tXWMLELCROUQ3uZC5wwS7n3J/XZHA8DWW2:K+tXTLEeRi+AlonVXHC
Malware Config
Extracted
mirai
LZRD
Signatures
-
Contacts a large (20384) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/net/tcp -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
description ioc File opened for reading /proc/net/tcp -
Reads runtime system information 27 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/422/fd File opened for reading /proc/734/exe File opened for reading /proc/669/exe File opened for reading /proc/181/fd File opened for reading /proc/354/fd File opened for reading /proc/422/exe File opened for reading /proc/738/exe File opened for reading /proc/202/fd File opened for reading /proc/759/exe File opened for reading /proc/714/exe File opened for reading /proc/383/fd File opened for reading /proc/429/exe File opened for reading /proc/691/exe File opened for reading /proc/400/fd File opened for reading /proc/698/exe File opened for reading /proc/719/exe File opened for reading /proc/385/fd File opened for reading /proc/343/fd File opened for reading /proc/397/fd File opened for reading /proc/429/fd File opened for reading /proc/730/exe File opened for reading /proc/667/exe File opened for reading /proc/695/exe File opened for reading /proc/720/exe File opened for reading /proc/1/fd File opened for reading /proc/721/exe File opened for reading /proc/434/fd
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/728-1-0x00400000-0x00455e28-memory.dmp