Analysis
-
max time kernel
123s -
max time network
156s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
-
submitted
30/12/2024, 19:52
General
-
Target
kwari.mips.elf
-
Size
74KB
-
MD5
2a7441fd44b33ecc989b2cf4def74e60
-
SHA1
9e13c4089b127d369307b71b58fd4b6a1648616e
-
SHA256
8da380266739599c81363273a4b1dd13bd9ecbaacd1b30083241ad8f7f0735ef
-
SHA512
89e3d18493d5fa3eca42122859a8a183dedaaa53078f0f8b88fe39c93f67a3b1cca24e311205da17bbe7d5755b6c6e972e91bbe8befcc74a97a87c697fffd57e
-
SSDEEP
1536:PCxBpGYuQsvvfI6MvdaGuT+Tp32xIogGrYzgp1J7:kLduhMMGumkxIogGrYsLF
Malware Config
Signatures
-
Contacts a large (223781) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Changes its process name 1 IoCs
-
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/kwari.mips.elf/tmp/kwari.mips.elf1⤵
- Modifies Watchdog functionality
- Changes its process name
- System Network Configuration Discovery