Analysis
-
max time kernel
152s -
max time network
159s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
-
submitted
29-02-2024 01:41
General
-
Target
ad5ed874bf9dec6bd2ef2189f69a6f8f
-
Size
31KB
-
MD5
ad5ed874bf9dec6bd2ef2189f69a6f8f
-
SHA1
3c131d59880774c3f2f047fce17c363ef19dc96e
-
SHA256
ec767b5d00d3d6f710cf6c61d5af564c070615a9535db017fac66b372e7c3aa3
-
SHA512
caaa361eeeb9c76735e51c7ac7fe9ad7a8adb8c59e0a244c452e813ba2bbd9bfa35f9fa6e6e8a1986cf8dba2e450fc1173802444980dda5ceda5f1731e09dc5b
-
SSDEEP
384:A3fpCLrsjHIX69URc+hmnulY1qHprFKt6zhS45vDajssVwfbvrGsUYa3FRWGVCzP:4fpWcehzJFYKgULAssKfbvPRa3zWH
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (20253) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 44 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/ad5ed874bf9dec6bd2ef2189f69a6f8f/tmp/ad5ed874bf9dec6bd2ef2189f69a6f8f1⤵