Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240226-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
19/04/2024, 13:44
General
-
Target
56a9a076d47d25f5d3882fd8d2bb58253e8d3d2a85d5c013f3aed6a160dc60e4.elf
-
Size
34KB
-
MD5
cd007fddc96eb0c050c4b9372168ed66
-
SHA1
cd7cc58f4bd24d6893a2d14fe26d8066e57c79a1
-
SHA256
56a9a076d47d25f5d3882fd8d2bb58253e8d3d2a85d5c013f3aed6a160dc60e4
-
SHA512
ac2038f437dda8377a74d3af5209235db3f18c95df99c387d0f0db42d6a9084d5140ef0958f136b99e6c9599979fa30486740b05a96064090130cb636547cda2
-
SSDEEP
768:X5BLyfH8exgwqtOvIbs5b11/PAl39QJgGlzDpUYsM:XyH8exg7Qb11/PAYVqYD
Malware Config
Extracted
Family
mirai
Botnet
UNSTABLE
Signatures
-
Contacts a large (217499) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a 711 56a9a076d47d25f5d3882fd8d2bb58253e8d3d2a85d5c013f3aed6a160dc60e4.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Writes file to system bin folder 1 TTPs 2 IoCs
description ioc File opened for modification /bin/watchdog File opened for modification /sbin/watchdog -
Reads runtime system information 26 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/668/cmdline Process not Found File opened for reading /proc/801/cmdline Process not Found File opened for reading /proc/813/cmdline Process not Found File opened for reading /proc/self/exe 56a9a076d47d25f5d3882fd8d2bb58253e8d3d2a85d5c013f3aed6a160dc60e4.elf File opened for reading /proc/675/cmdline Process not Found File opened for reading /proc/742/cmdline Process not Found File opened for reading /proc/774/cmdline Process not Found File opened for reading /proc/709/cmdline Process not Found File opened for reading /proc/722/cmdline Process not Found File opened for reading /proc/417/cmdline Process not Found File opened for reading /proc/689/cmdline Process not Found File opened for reading /proc/703/cmdline Process not Found File opened for reading /proc/704/cmdline Process not Found File opened for reading /proc/710/cmdline Process not Found File opened for reading /proc/721/cmdline Process not Found File opened for reading /proc/775/cmdline Process not Found File opened for reading /proc/716/cmdline Process not Found File opened for reading /proc/779/cmdline Process not Found File opened for reading /proc/672/cmdline Process not Found File opened for reading /proc/706/cmdline Process not Found File opened for reading /proc/715/cmdline Process not Found File opened for reading /proc/814/cmdline Process not Found File opened for reading /proc/676/cmdline Process not Found File opened for reading /proc/714/cmdline Process not Found File opened for reading /proc/717/cmdline Process not Found File opened for reading /proc/787/cmdline Process not Found