Analysis
-
max time kernel
144s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
-
submitted
27-01-2025 23:02
General
-
Target
wanna.mips.elf
-
Size
99KB
-
MD5
77d4d8ce65ff25fbf93bd1ff179c9325
-
SHA1
6d9ea0fe4cb509b12c1cb0ab6c5750d36241507d
-
SHA256
6c311fd3d94d8e9f55e5ae56c71f91a38685bdb4bdb05a21402aaad89211436d
-
SHA512
5da5f8c4375c5bdcbe410a5bfffdc20fb7b3d981647d7b1a30e4f73b02aa835f26950010375a4a0379759d570658323695c9ffcdda21c8784b929c34e2982f98
-
SSDEEP
1536:pegXznytTDLmgKQ29A0v+iRbNxcLPkXK7wYvmG6aa7GBmd9:jiDEA0WKbNx3XK7wYv1jaiBK9
Malware Config
Signatures
-
Contacts a large (20453) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 29 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/wanna.mips.elf/tmp/wanna.mips.elf1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
- System Network Configuration Discovery