Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
-
submitted
26-03-2024 13:12
General
-
Target
df4144d4e15eb528cbb3d62896cb3bb4
-
Size
29KB
-
MD5
df4144d4e15eb528cbb3d62896cb3bb4
-
SHA1
bc1b8bc0edcc4be0cf01d24dce9549316dc95fa6
-
SHA256
53e43078220f164963ca7aa648fb981e7f39e34c6b26d98eaf8148e8070d11c9
-
SHA512
2b658b113e52e6c148e55e8b50d3e2d423a04949797a31bfd9c68cffc0677b57efd3557beb87af570658a03e4de7edbdd4f8fa1e46b02342e3e894cdda60f021
-
SSDEEP
768:ad9c3tP8gJHcHMHygJT+lk30vmOhLX8o0jfXXs3Uozy:gEpdJMyIue/Mpj/Kzy
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (20428) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 58 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/df4144d4e15eb528cbb3d62896cb3bb4/tmp/df4144d4e15eb528cbb3d62896cb3bb41⤵
- Reads runtime system information