Overview

overview

10

Static

static

10

dba6d7c0d7...8ee7a8

debian-12-mipsel

9

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    debian-12_mipsel
  • resource
    debian12-mipsel-20240221-en
  • resource tags

    arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
  • submitted
    21-03-2024 12:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dba6d7c0d781cf800a626d13978ee7a8

  • Size

    89KB

  • MD5

    dba6d7c0d781cf800a626d13978ee7a8

  • SHA1

    dc9019376d862b799bde2b65791789c9022bf0b7

  • SHA256

    983ed7c7e23e81bd3896854e4a301695a23c5a0a32425e30651feab3e7dc6d06

  • SHA512

    be7b739f1d0b86492c9f842354df951c8f79fcc15a7ca2517d46028ea39bdbfcaa12e37b2bfc9696af6a7cd584f2a8be322dc09f855358561ff099cf69d87ec7

  • SSDEEP

    1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZqxi:qCYxrKDy46Ni

Score
9/10
discovery

Malware Config

Signatures

  • Contacts a large (20319) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 43 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/dba6d7c0d781cf800a626d13978ee7a8
    /tmp/dba6d7c0d781cf800a626d13978ee7a8
    1⤵
      PID:724

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Impair Defenses

    1
    T1562

    Credential Access

    Discovery

    Network Service Discovery

    2
    T1046

    System Network Connections Discovery

    1
    T1049

    System Network Configuration Discovery

    1
    T1016

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads