Analysis
-
max time kernel
149s -
max time network
153s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
-
submitted
26-03-2024 22:12
General
-
Target
e037dd203b458d0d59684e2154efc8b5
-
Size
29KB
-
MD5
e037dd203b458d0d59684e2154efc8b5
-
SHA1
95ba15e1ce1a3577fb03c99eeb3b29df5c85f729
-
SHA256
9af511d1ca0efbca71c1f396c92a2406b9413d4228b5ff346e22549d92a06f63
-
SHA512
187ed782dcd91eddea75acfdf53cdb3593cd1e2be487432e4cb07fa60b2555a00e6cd1960bf5be130a5a4128631128806b50000959ffd464dce9069efff07b60
-
SSDEEP
768:xN8fWlfoQmQAXV7E/QciiRcLprDKTJazqg:jMNXFl76N4PCm
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (20366) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/e037dd203b458d0d59684e2154efc8b5/tmp/e037dd203b458d0d59684e2154efc8b51⤵