Analysis
-
max time kernel
149s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
-
submitted
05-09-2024 12:22
General
-
Target
SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf
-
Size
29KB
-
MD5
0e9baddd505edcaf077b6935323b608f
-
SHA1
8cedefd89863bf40ea986e8a0ed6bdaf5b3cd6e5
-
SHA256
f5a9ea37f7c2b08313ca8da83d0e0685d5539d3ae23a2276bcd22513a97b5b39
-
SHA512
22cf27fe8af73422d53bdf90737384f1add00f64952a1b63eda85f0d4b65c9876351c82fb3ff2ee95f489a58539145a68352c3e65fb3c01584de0a6f18b7241f
-
SSDEEP
768:WiD2DsL6HKyWt2KCLcK1A5RVBTKgGws3UozK:524L69W9K1OHYzK
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (20358) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 33 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf/tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf1⤵
- Modifies Watchdog functionality
- Reads runtime system information