General

  • Target

    boatnet.x86.elf

  • Size

    20KB

  • Sample

    230426-j69jpaaa2t

  • MD5

    19e1c26ccbec0fb8ccbb68b99ed8c631

  • SHA1

    34679a3768eb7f2f776ed903c2eca6bfdc5da0c7

  • SHA256

    2b39b424552e8feba39ab2050d61c87abb2aabf56c720133df5cc88b12696c75

  • SHA512

    e0bc13b65b5e1662c5d17e1c4f6603cc29ed9c7fefaef0eb3163df7cc9cc2ccc3b3dc1bcc80eec2be6960980aa2bb1b1429f5d0783b1303012bd7e6b30067aac

  • SSDEEP

    384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKE:O98o08kxofBE+ZkXaqGbp2F2TWul0c5Z

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      boatnet.x86.elf

    • Size

      20KB

    • MD5

      19e1c26ccbec0fb8ccbb68b99ed8c631

    • SHA1

      34679a3768eb7f2f776ed903c2eca6bfdc5da0c7

    • SHA256

      2b39b424552e8feba39ab2050d61c87abb2aabf56c720133df5cc88b12696c75

    • SHA512

      e0bc13b65b5e1662c5d17e1c4f6603cc29ed9c7fefaef0eb3163df7cc9cc2ccc3b3dc1bcc80eec2be6960980aa2bb1b1429f5d0783b1303012bd7e6b30067aac

    • SSDEEP

      384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKE:O98o08kxofBE+ZkXaqGbp2F2TWul0c5Z

    Score
    10/10
    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Tasks