Analysis
-
max time kernel
134s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
-
submitted
13-12-2024 00:53
General
-
Target
697-1-0x00400000-0x00450c38-memory.dmp
-
Size
65KB
-
MD5
171d706403a5accca74bd7abed4d839a
-
SHA1
c288f0de6b9f474ffe70b976f277a8955fd4d38f
-
SHA256
cb9250bd60d3282a5cf3c8c4d64c039ca19e346bee00d4b57a9b9b6739a9fdf8
-
SHA512
a40fa8f250598c7fe25943109721fd852c92ce648a7eec6aadf710953d01311f14bfad0b5fbde8a76b13da237c4b15d5ed29eac4d8ebfef6c49e3f6822ca5e64
-
SSDEEP
768:YQbnZz+D0GvXIdoy9l8wMrOZE3JLbwWehGXAZZaCAkdX9yYgFdPOZAl/rRUo:1bnZ4nyZ4wMryoehcAZZaa2bPOZAvUo
Malware Config
Signatures
-
Contacts a large (69905) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 43 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/697-1-0x00400000-0x00450c38-memory.dmp/tmp/697-1-0x00400000-0x00450c38-memory.dmp1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information