Analysis
-
max time kernel
149s -
max time network
192s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
03/08/2024, 22:34
General
-
Target
3c25f39e80f7cc6bbe607ba99e3dc248.elf
-
Size
35KB
-
MD5
3c25f39e80f7cc6bbe607ba99e3dc248
-
SHA1
45d40c50b801f96d2d14b9f453fa0247e6a6d842
-
SHA256
99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec
-
SHA512
b2bc638d2d8f76c1fba2a781b922ebb04ba7a59f9675aec33fab9b62dbf20ae37067a5435a4164319d14ab374f3e83f4d79ff1ce26084dc80e65db5f90e3984a
-
SSDEEP
768:oPRpsskbodln+2j9nGblZenQDuQVTNUhC4l/RLwf+ch/49q3UELr:w+bf2j9eEnyuQjU9hRLwmc5hLr
Malware Config
Extracted
mirai
LZRD
Signatures
-
Contacts a large (20453) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for modification /dev/misc/watchdog 3c25f39e80f7cc6bbe607ba99e3dc248.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 3c25f39e80f7cc6bbe607ba99e3dc248.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 3c25f39e80f7cc6bbe607ba99e3dc248.elf -
Reads runtime system information 41 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/716/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/716/exe 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/720/exe 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/1/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/338/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/363/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/657/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/682/exe 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/187/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/325/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/642/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/715/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/718/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/642/exe 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/665/exe 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/702/exe 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/665/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/683/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/687/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/641/exe 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/739/exe 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/300/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/355/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/682/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/344/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/711/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/707/exe 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/self/exe 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/212/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/326/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/351/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/346/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/641/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/657/exe 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/713/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/720/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/658/exe 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/706/exe 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/274/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/658/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf File opened for reading /proc/685/fd 3c25f39e80f7cc6bbe607ba99e3dc248.elf