Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
03/08/2024, 15:57
General
-
Target
19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf
-
Size
30KB
-
MD5
2a53030bb17ff781f18e413ff5d0b67f
-
SHA1
a511d1efd9acac2e01baa8b1aeb4d85c25e31c7d
-
SHA256
19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33
-
SHA512
b1c724e23656974178df590acde4eb1941e36c907f5ef48c8a5bbe8c5b18502b96d81a89b7eaef3ec0ee5156093bf5b2f1badfd6d1e997337467d31afd02a7a2
-
SSDEEP
768:GHiX0hIAjIBfYwftE+k4TG4u6idlBiBjFEqftvJgGlzDpbuR1Je:GWEIBwwftlPCezttVJuw
Malware Config
Extracted
mirai
MIRAI
Signatures
-
Contacts a large (20449) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for modification /dev/misc/watchdog 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf -
Reads runtime system information 23 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/381/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/663/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/391/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/657/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/664/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/145/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/166/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/330/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/331/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/380/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/652/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/656/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/680/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/1/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/328/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/334/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/340/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/688/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/691/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/243/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/366/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/679/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf File opened for reading /proc/690/fd 19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33.elf