Analysis
-
max time kernel
150s -
max time network
153s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240226-en -
resource tags
-
submitted
08-04-2024 11:40
General
-
Target
e760c3ae6a8a16735523e8a299136758_JaffaCakes118
-
Size
31KB
-
MD5
e760c3ae6a8a16735523e8a299136758
-
SHA1
e3f8527bb11ebaa747fc0d14d861d90ee5449588
-
SHA256
880805855e0e0920f84f5d177789b399bbc66da9cd2fef1dc90b8b717ec3d908
-
SHA512
3fb1c44cb925caf8b47b99d61fc12a0061b3be392b95fb13c493133c2649c5f18a660816c3232c5db3f0ecc095e405e71c29b4a1cac55534c721fd1a1557ff6e
-
SSDEEP
768:LwmOK8LjpZeRQwb+xob22HTCB+x8MeMTWT:UceZJa+xodCB+SFMq
Malware Config
Extracted
mirai
MIRAI
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (20491) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/e760c3ae6a8a16735523e8a299136758_JaffaCakes118/tmp/e760c3ae6a8a16735523e8a299136758_JaffaCakes1181⤵