Overview

overview

10

Static

static

10

main_mips.elf

debian-9-mips

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    main_mips.elf

  • Size

    63KB

  • Sample

    241206-jl7jlaxkbx

  • MD5

    9f483744b8583a4eae230da3a8e8a700

  • SHA1

    2d9cbdd199707e8589feb927c18d7246badbee8f

  • SHA256

    ef6e15058637657abcb442349b99573fd7be2d765c7cefed29a562c9d62d4655

  • SHA512

    3114cbd69bdda45fcb05ea757b26472c2099366359427fd3c1bf6cbf157c753bd580a8e7dd41b4f648a20da58f632e8236a1424097279e5954b0c82d12ef8980

  • SSDEEP

    1536:aHQTY/+kxmbZYUOqoXrS3zT0AioGBnNBkBn:awTb9Z3OlQT0Aiocns

Score
10/10
miraidefense_evasiondiscovery

Malware Config

Targets

    • Target

      main_mips.elf

    • Size

      63KB

    • MD5

      9f483744b8583a4eae230da3a8e8a700

    • SHA1

      2d9cbdd199707e8589feb927c18d7246badbee8f

    • SHA256

      ef6e15058637657abcb442349b99573fd7be2d765c7cefed29a562c9d62d4655

    • SHA512

      3114cbd69bdda45fcb05ea757b26472c2099366359427fd3c1bf6cbf157c753bd580a8e7dd41b4f648a20da58f632e8236a1424097279e5954b0c82d12ef8980

    • SSDEEP

      1536:aHQTY/+kxmbZYUOqoXrS3zT0AioGBnNBkBn:awTb9Z3OlQT0Aiocns

    Score
    9/10
    defense_evasiondiscovery

    • Contacts a large (56042) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

      discovery

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks