Analysis
-
max time kernel
150s -
max time network
151s -
platform
debian-12_armhf -
resource
debian12-armhf-20240729-en -
resource tags
-
submitted
05-09-2024 12:22
General
-
Target
SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf
-
Size
52KB
-
MD5
dd979274e98e98c09cec002bbb9463b0
-
SHA1
4be98164f9324eb25fc688964c19c5c004e60e6c
-
SHA256
6fd2b5684b508d9cb2c316daad9964381fdb3e3e73ebfe26f0c977385980452b
-
SHA512
646c2f2e27b428cad0b6a802493a5fc6f3a67dd6ef886e3f81b7bd7d8ad4bd0ed085f23d0617012b3ca34b06847110e8e1debf2be91474b3f529887942163315
-
SSDEEP
1536:f/fQx7LSrHzswsw5bj9uRDRLWdR5tgZ6c9ot4:P27Oi+MRlLsrtgZ6Oc4
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (20505) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads runtime system information 13 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf/tmp/SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf1⤵
- Modifies Watchdog functionality
- Reads runtime system information