Analysis
-
max time kernel
149s -
max time network
150s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
-
submitted
11-12-2024 23:02
General
-
Target
jew.mips.elf
-
Size
125KB
-
MD5
8c71a090f8e8287ac269fa24117998e7
-
SHA1
8cd281fccccae7ebb46308129f9cbba21ed35002
-
SHA256
7b5a84fdb5494cd62c43116ebb5494b9886f54712f306283782c5610a622309c
-
SHA512
6c6d2b2dccd2df27b436994fc260de38e9d5af4641f97398735ddb24c025a6f35c31ad1f5a92160938d65354475a72f5088ba47ee96ef5dfa3d98533e5aa8c31
-
SSDEEP
3072:k9CY3nsXRx2+hhnSXsxVLdEgrUpziNn3Ik8LINFb1lNWYB:k9CY3nsXRx2+hcXsxVLdEgrUrWFb1lNL
Score
9/10
Malware Config
Signatures
-
Contacts a large (116556) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 2 IoCs
-
Changes its process name 1 IoCs
-
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/jew.mips.elf/tmp/jew.mips.elf1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
- System Network Configuration Discovery