Analysis
-
max time kernel
150s -
max time network
152s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
02/08/2024, 11:47
General
-
Target
SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf
-
Size
30KB
-
MD5
2a53030bb17ff781f18e413ff5d0b67f
-
SHA1
a511d1efd9acac2e01baa8b1aeb4d85c25e31c7d
-
SHA256
19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33
-
SHA512
b1c724e23656974178df590acde4eb1941e36c907f5ef48c8a5bbe8c5b18502b96d81a89b7eaef3ec0ee5156093bf5b2f1badfd6d1e997337467d31afd02a7a2
-
SSDEEP
768:GHiX0hIAjIBfYwftE+k4TG4u6idlBiBjFEqftvJgGlzDpbuR1Je:GWEIBwwftlPCezttVJuw
Malware Config
Extracted
mirai
MIRAI
Signatures
-
Contacts a large (20541) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for modification /dev/misc/watchdog SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf -
Reads runtime system information 23 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/433/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/708/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/709/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/719/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/720/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/358/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/362/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/678/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/1/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/244/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/337/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/361/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/388/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/675/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/684/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/695/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/151/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/173/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/391/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/685/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/717/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/333/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf File opened for reading /proc/386/fd SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf