Overview

overview

10

Static

static

10

715-1-0x00...ry.dmp

debian-12-mipsel

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    715-1-0x00400000-0x00450c38-memory.dmp

  • Size

    65KB

  • Sample

    241213-bbtkzstkd1

  • MD5

    bbfaa0ea6a2044267daa028194822707

  • SHA1

    28817dd4e43941660c9932cc5e4b33875d85d4f4

  • SHA256

    94f871ab8115363cbd137538c7ca247fe45bc50cfb76bcabb4f816c0d6855e60

  • SHA512

    3a0331b99deed85aa3543766e3555956f76641904260ec3c79c8425147b399e59b7ed282703453fff433a02a267329153f91e7293fda3324ee37ed89e35c038c

  • SSDEEP

    1536:H2VhIeHeQFggLOI4mXDDd0NcsRZ9HwQprgj:WVhIe+QiHcsRh+

Score
10/10
miraidefense_evasiondiscovery

Malware Config

Targets

    • Target

      715-1-0x00400000-0x00450c38-memory.dmp

    • Size

      65KB

    • MD5

      bbfaa0ea6a2044267daa028194822707

    • SHA1

      28817dd4e43941660c9932cc5e4b33875d85d4f4

    • SHA256

      94f871ab8115363cbd137538c7ca247fe45bc50cfb76bcabb4f816c0d6855e60

    • SHA512

      3a0331b99deed85aa3543766e3555956f76641904260ec3c79c8425147b399e59b7ed282703453fff433a02a267329153f91e7293fda3324ee37ed89e35c038c

    • SSDEEP

      1536:H2VhIeHeQFggLOI4mXDDd0NcsRZ9HwQprgj:WVhIe+QiHcsRh+

    Score
    9/10
    defense_evasiondiscovery

    • Contacts a large (50278) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

      discovery

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks