Analysis
-
max time kernel
149s -
max time network
152s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
-
submitted
08-04-2024 17:20
General
-
Target
e80061af37aa728eb1ab1f8e0b75517b_JaffaCakes118
-
Size
52KB
-
MD5
e80061af37aa728eb1ab1f8e0b75517b
-
SHA1
9936a98147ff22cefd59f73c45f208b6a9b579a7
-
SHA256
61e72921103f4ed5efacfdc6239febf5ac52238a078020ead4e3cd5ce394dc1c
-
SHA512
75852770ce1a9c5e86854e857e5bd8b9e9e4e50a2ffe6b67b092d4a36e12697855038c39392b7c631525aa2f060f2be60821340364c49c1ba3759636d963b63d
-
SSDEEP
1536:+Y3AmUi3ML4EkwjIQV5WW+PTlL9FtLV2xourV:/753lWI+5P+PBLLtR2Fx
Malware Config
Extracted
mirai
MIRAI
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (20706) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 28 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/e80061af37aa728eb1ab1f8e0b75517b_JaffaCakes118/tmp/e80061af37aa728eb1ab1f8e0b75517b_JaffaCakes1181⤵
- Reads runtime system information