Analysis
-
max time kernel
149s -
max time network
153s -
platform
debian-12_armhf -
resource
debian12-armhf-20240729-en -
resource tags
arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
04/08/2024, 01:23
General
-
Target
69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf
-
Size
52KB
-
MD5
23d74e263d1bde58ccd65ce4ec8f548f
-
SHA1
800671815fa9249de704fa930dbb59871e4ad89b
-
SHA256
69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc
-
SHA512
fa4ab5a66673bf2b0cffdbb2af04c13f8c4db20d43814e7b616b044ca3a6ac0c6e53978261b6f7368597828527cd2a84a425164a6763835250e6a8cabb59af27
-
SSDEEP
768:/Mte5B4PACtw/YcmRIe18D9q63TxZQbSORe7Su2QJnKE79TLrP59q3UELbOs8qMV:/M84ISRX63dZQbS5rzZ0LIVmWjB
Malware Config
Extracted
mirai
LZRD
Signatures
-
Contacts a large (20486) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for modification /dev/misc/watchdog 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf -
Reads runtime system information 43 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/706/exe 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/372/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/662/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/702/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/699/exe 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/711/exe 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/732/exe 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/666/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/711/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/693/exe 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/709/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/647/exe 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/698/exe 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/186/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/212/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/290/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/703/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/705/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/715/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/662/exe 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/678/exe 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/325/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/348/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/359/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/647/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/708/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/703/exe 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/666/exe 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/327/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/631/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/646/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/631/exe 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/277/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/354/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/678/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/679/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/681/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/706/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/646/exe 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/1/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/338/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/346/fd 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf File opened for reading /proc/self/exe 69a6ca5df903815f85acc9697d85375be9d3d07692d57dcc83bd92ff237321bc.elf