Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240226-en -
resource tags
-
submitted
11-03-2024 19:31
General
-
Target
c16a7d61a7d58b1da60b829652e3ede4
-
Size
31KB
-
MD5
c16a7d61a7d58b1da60b829652e3ede4
-
SHA1
0eaf84129db36ac99d6ad0d0dcc3f6aeb4c0dfdd
-
SHA256
be63a1bcbd5207557d3653428dd423ae31613c0e435e39db3ec3fb1db406ea6b
-
SHA512
1388f32436a061b3dc855d4e3bbc29df6d9366fee779de38c71ce14cecf6f16566867001d1e8e001acf55cc86a04810c17e506ab367357f1477dd9f2e96571c6
-
SSDEEP
768:nGNYYDM+O2/fN7sUHgV87jA4JgGlzDpxYswj:nGLS2nRsUjXA4VrYXj
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (24143) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads runtime system information 19 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/c16a7d61a7d58b1da60b829652e3ede4/tmp/c16a7d61a7d58b1da60b829652e3ede41⤵
- Reads runtime system information