Analysis
-
max time kernel
149s -
max time network
154s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240226-en -
resource tags
-
submitted
10-04-2024 07:44
General
-
Target
ea94ddcee87355122583bb3605c693c7_JaffaCakes118
-
Size
28KB
-
MD5
ea94ddcee87355122583bb3605c693c7
-
SHA1
b392244ad70defab668cf64729d493c64a326497
-
SHA256
da843c429f677f1c8911e576e0ba33704fdfb41e7a2dde69d51929ca5244d38a
-
SHA512
29476265af5e5449192baf89769c6f117cf7a630b0df498fc980b05ab6317434a1dbe4a86aa46a65a6464adaef5b68ae01d6943ea00239c892fccdf99d3a85ec
-
SSDEEP
384:syr3engrGqzZLZCQJKM8+xwPFiV3QOLoYAgX8QzE7OPaNOMMsRWGVCz0Nvk+:s43NFLZCIvxwwZkVQGoqW2
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (20017) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 42 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/ea94ddcee87355122583bb3605c693c7_JaffaCakes118/tmp/ea94ddcee87355122583bb3605c693c7_JaffaCakes1181⤵