Analysis
-
max time kernel
118s -
max time network
154s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
27-12-2024 03:14
Behavioral task
behavioral1
Sample
744-1-0x00400000-0x00455bd8-memory.dmp
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
7 signatures
150 seconds
General
-
Target
744-1-0x00400000-0x00455bd8-memory.dmp
-
Size
85KB
-
MD5
494c23b6b0e3b5ea476dd4d77c3ff3d7
-
SHA1
9f84e33eece2e51060aeb0035206990f7146393e
-
SHA256
f1fc499853eb7d989a225193213930f955755b46d7e4ee47842a5a9c0ec0a41e
-
SHA512
6236b96e7368c8234d6169d907355207b78d343b8f32004ab9e2bf11aca753e081afcb9bffd6ecd57d818add00cdbcff332294165bfea036ce3bbe7e7f1b7043
-
SSDEEP
1536:73SU2qK0YBEio6jlhDwYfMcQPueTEPzA5D3/JH2I:7SfqujliCUDgI
Score
9/10
Malware Config
Signatures
-
Contacts a large (16085) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 744-1-0x00400000-0x00455bd8-memory.dmp File opened for modification /dev/misc/watchdog 744-1-0x00400000-0x00455bd8-memory.dmp -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 744-1-0x00400000-0x00455bd8-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 744-1-0x00400000-0x00455bd8-memory.dmp -
description ioc Process File opened for reading /proc/750/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/736/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/813/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/379/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/380/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/752/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/801/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/804/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/180/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/667/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/737/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/695/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/718/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/723/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/765/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/396/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/712/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/742/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/710/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/753/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/753/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/680/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/346/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/680/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/695/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/714/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/736/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/697/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/710/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/356/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/391/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/409/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/409/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/714/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/738/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/764/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/809/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/424/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/757/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/408/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/755/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/811/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/408/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/679/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/697/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/750/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/667/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/1/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/202/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/377/fd 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/679/exe 744-1-0x00400000-0x00455bd8-memory.dmp File opened for reading /proc/814/exe 744-1-0x00400000-0x00455bd8-memory.dmp