Analysis
-
max time kernel
149s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
04/08/2024, 01:06
General
-
Target
13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf
-
Size
33KB
-
MD5
e89da602263ac13efc9488b5dd953be0
-
SHA1
a8ea216a90ee5560705526322ab164116ddbc169
-
SHA256
13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90
-
SHA512
d1f55bf7fac629e773bcf188f0a61ff4e436a541081e6043d38685904e4bac4e1d2282007ef1ab20ccf145e987f9c6d5e3d369ce9204e3e6340e2fda2981313a
-
SSDEEP
768:N+al232dYE8jkwbwu2p5KPDMun7y0s3UozvE:3l2GqEsI8DMun7+zvE
Malware Config
Extracted
mirai
LZRD
Signatures
-
Contacts a large (20276) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for modification /dev/misc/watchdog 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf -
Reads runtime system information 58 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/284/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/680/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/274/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/329/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/442/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/706/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/655/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/167/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/318/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/613/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/667/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/438/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/1/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/394/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/782/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/802/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/222/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/660/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/666/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/650/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/732/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/786/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/287/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/398/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/800/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/438/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/650/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/780/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/784/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/796/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/651/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/790/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/660/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/288/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/306/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/653/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/661/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/657/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/651/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/663/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/656/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/788/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/137/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/661/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/613/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/674/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/702/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/self/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/286/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/671/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/792/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/667/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/798/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/803/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/304/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/664/fd 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/442/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf File opened for reading /proc/794/exe 13aa2c9320552bf2e68138fd6b2a5be35c5f95000a5306d89af5a35b41a14f90.elf