Analysis
-
max time kernel
150s -
max time network
157s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
-
submitted
14-11-2024 03:12
General
-
Target
dvwkja7.elf
-
Size
50KB
-
MD5
1fd1d4c09b1c1026184e73fe59e83d8b
-
SHA1
4eaadfe62344676092d4d7917ddaab5b99643f0d
-
SHA256
f61704e951df85cef6efedaf3652904fbc1bdc8a6d59ea5fc31dcf57c355b2ea
-
SHA512
cf1926eb9aad95a5053fb8ecd5c45272abba08a37aaf9b3550d4afd144986cf2d55624902f1dbb8a19c0af2268932652996c320732a2c9027ac56d98a4dec0e6
-
SSDEEP
1536:uCoqsGR4eB3g0Vmh1IxIpC8JjL9VE8amFZP7R3Q:Xoqs2Twh6P8JjLJ9ZP7R3Q
Malware Config
Extracted
mirai
SORA
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Contacts a large (165593) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 31 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/dvwkja7.elf/tmp/dvwkja7.elf1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information