Analysis
-
max time kernel
150s -
max time network
156s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
03/08/2024, 21:51
General
-
Target
xd.arm7.elf
-
Size
52KB
-
MD5
23d74e263d1bde58ccd65ce4ec8f548f
-
SHA1
800671815fa9249de704fa930dbb59871e4ad89b
-
SHA256
69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc
-
SHA512
fa4ab5a66673bf2b0cffdbb2af04c13f8c4db20d43814e7b616b044ca3a6ac0c6e53978261b6f7368597828527cd2a84a425164a6763835250e6a8cabb59af27
-
SSDEEP
768:/Mte5B4PACtw/YcmRIe18D9q63TxZQbSORe7Su2QJnKE79TLrP59q3UELbOs8qMV:/M84ISRX63dZQbS5rzZ0LIVmWjB
Malware Config
Extracted
mirai
LZRD
Signatures
-
Contacts a large (19875) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog xd.arm7.elf File opened for modification /dev/misc/watchdog xd.arm7.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp xd.arm7.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp xd.arm7.elf -
Reads runtime system information 27 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/329/fd xd.arm7.elf File opened for reading /proc/720/exe xd.arm7.elf File opened for reading /proc/188/fd xd.arm7.elf File opened for reading /proc/575/exe xd.arm7.elf File opened for reading /proc/252/fd xd.arm7.elf File opened for reading /proc/742/exe xd.arm7.elf File opened for reading /proc/319/fd xd.arm7.elf File opened for reading /proc/212/fd xd.arm7.elf File opened for reading /proc/715/exe xd.arm7.elf File opened for reading /proc/445/exe xd.arm7.elf File opened for reading /proc/570/exe xd.arm7.elf File opened for reading /proc/687/exe xd.arm7.elf File opened for reading /proc/self/exe xd.arm7.elf File opened for reading /proc/326/fd xd.arm7.elf File opened for reading /proc/312/fd xd.arm7.elf File opened for reading /proc/358/fd xd.arm7.elf File opened for reading /proc/444/exe xd.arm7.elf File opened for reading /proc/705/exe xd.arm7.elf File opened for reading /proc/709/exe xd.arm7.elf File opened for reading /proc/347/fd xd.arm7.elf File opened for reading /proc/344/fd xd.arm7.elf File opened for reading /proc/668/exe xd.arm7.elf File opened for reading /proc/710/exe xd.arm7.elf File opened for reading /proc/1/fd xd.arm7.elf File opened for reading /proc/342/fd xd.arm7.elf File opened for reading /proc/718/exe xd.arm7.elf File opened for reading /proc/321/fd xd.arm7.elf