Analysis
-
max time kernel
52s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
-
submitted
27-12-2024 12:06
General
-
Target
656-1-0x00008000-0x0002d52c-memory.dmp
-
Size
104KB
-
MD5
c0ee6beb462104f74fa44ce867a8efa5
-
SHA1
1425a7d174f9774412d852d255a99387ee1390a2
-
SHA256
70a8bd95a80fc2c32964cc394bd04f3dfce28ef388b80f545a28fddbb73803f0
-
SHA512
652e28b656580ab84c03de1a410c3647d490f45308a1561d0c210da1d143d4639b6233adc68bd80f14c5799f30cb1ea11f253df19f06970e8bf2106aecc0d54e
-
SSDEEP
1536:LxnDNGnEkYBnmzzwrQJ0J5W5KC93BIrAXHhVHhpFRcJ9UckVZ9l3Di7ARru0oYzJ:anWnEzVWI/9QG/HhpFRcJ9UcI9Rr/T
Score
9/10
Malware Config
Signatures
-
Contacts a large (196397) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 2 IoCs
-
Changes its process name 1 IoCs
-
Reads runtime system information 24 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/656-1-0x00008000-0x0002d52c-memory.dmp/tmp/656-1-0x00008000-0x0002d52c-memory.dmp1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
- Reads runtime system information