Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
21-04-2024 00:10
General
-
Target
8374373a2be97dcc625de716147ff1fe
-
Size
74KB
-
MD5
8374373a2be97dcc625de716147ff1fe
-
SHA1
629895abb50371a12550a0720c4c410119dd1d23
-
SHA256
80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969
-
SHA512
cb4093b62495432dbd9fec90644556d3dc28dbf455cfc5787dd4d2880cd5221ae7f7a1913642e215fb6be9b4779a262b37f59dac8ba28b05bf9eca0f3e19d9e8
-
SSDEEP
1536:/AZlz2ROCO6/fvqz/HYmGNZcYKb7k2v2H8pdqE1Cp:/AZIzQAcYKb7k2LpXCp
Malware Config
Signatures
-
Contacts a large (20451) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Processes:
8374373a2be97dcc625de716147ff1fedescription ioc process File deleted /var/log/audit/audit.log 8374373a2be97dcc625de716147ff1fe -
Deletes itself 1 IoCs
Processes:
8374373a2be97dcc625de716147ff1fepid process 646 8374373a2be97dcc625de716147ff1fe -
Deletes system logs 1 TTPs 2 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
Processes:
8374373a2be97dcc625de716147ff1fedescription ioc process File deleted /var/log/syslog 8374373a2be97dcc625de716147ff1fe File deleted /var/log/messages 8374373a2be97dcc625de716147ff1fe -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
8374373a2be97dcc625de716147ff1fedescription ioc process File opened for modification /dev/watchdog 8374373a2be97dcc625de716147ff1fe File opened for modification /dev/misc/watchdog 8374373a2be97dcc625de716147ff1fe -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 186.194.195.5 Destination IP 179.106.56.243 Destination IP 191.240.241.177 Destination IP 191.240.239.66 Destination IP 186.194.197.103 -
Deletes log files 1 TTPs 3 IoCs
Deletes log files on the system.
Processes:
8374373a2be97dcc625de716147ff1fedescription ioc process File deleted /var/log/wtmp 8374373a2be97dcc625de716147ff1fe File deleted /var/log/daemon.log 8374373a2be97dcc625de716147ff1fe File deleted /var/log/kern.log 8374373a2be97dcc625de716147ff1fe -
Changes its process name 1 IoCs
Processes:
8374373a2be97dcc625de716147ff1fedescription ioc pid process Changes the process name, possibly in an attempt to hide itself avb51eijc2rivc1g61duwqh6 646 8374373a2be97dcc625de716147ff1fe