Analysis
-
max time kernel
149s -
max time network
152s -
platform
debian-12_armhf -
resource
debian12-armhf-20240729-en -
resource tags
arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
04/08/2024, 01:40
General
-
Target
99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf
-
Size
35KB
-
MD5
3c25f39e80f7cc6bbe607ba99e3dc248
-
SHA1
45d40c50b801f96d2d14b9f453fa0247e6a6d842
-
SHA256
99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec
-
SHA512
b2bc638d2d8f76c1fba2a781b922ebb04ba7a59f9675aec33fab9b62dbf20ae37067a5435a4164319d14ab374f3e83f4d79ff1ce26084dc80e65db5f90e3984a
-
SSDEEP
768:oPRpsskbodln+2j9nGblZenQDuQVTNUhC4l/RLwf+ch/49q3UELr:w+bf2j9eEnyuQjU9hRLwmc5hLr
Malware Config
Extracted
mirai
LZRD
Signatures
-
Contacts a large (20290) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for modification /dev/misc/watchdog 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf -
Reads runtime system information 34 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/781/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/785/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/817/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/350/fd 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/352/fd 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/698/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/713/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/649/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/704/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/1/fd 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/322/fd 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/332/fd 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/752/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/821/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/827/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/648/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/683/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/190/fd 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/302/fd 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/326/fd 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/705/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/717/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/264/fd 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/664/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/666/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/782/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/209/fd 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/348/fd 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/631/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/679/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/323/fd 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/362/fd 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/710/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf File opened for reading /proc/self/exe 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf