General

  • Target

    boatnet.x86.elf

  • Size

    20KB

  • Sample

    230428-2ss9naaf8z

  • MD5

    eff2c8004a320ecfa7cb3fb984bbe7ee

  • SHA1

    a2bbbe0de0ba61e3afdbdc0c4e1505d155ad7ba1

  • SHA256

    834c2b411dc3e26220ddc4b1c797972dfcc32f4b140aadb7daa97bee7bd81f1e

  • SHA512

    7dabdc35515099f0a990fb3d81fc6d7b01b79a9213621e09b05d900cefc7044084e43e6c3ac79d1a29630403c28e6f632a011d8e2b42f200747805a94345f19f

  • SSDEEP

    384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtCHSy+:O98o08kxofBE+ZkXaT47C2EpitCN+

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      boatnet.x86.elf

    • Size

      20KB

    • MD5

      eff2c8004a320ecfa7cb3fb984bbe7ee

    • SHA1

      a2bbbe0de0ba61e3afdbdc0c4e1505d155ad7ba1

    • SHA256

      834c2b411dc3e26220ddc4b1c797972dfcc32f4b140aadb7daa97bee7bd81f1e

    • SHA512

      7dabdc35515099f0a990fb3d81fc6d7b01b79a9213621e09b05d900cefc7044084e43e6c3ac79d1a29630403c28e6f632a011d8e2b42f200747805a94345f19f

    • SSDEEP

      384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtCHSy+:O98o08kxofBE+ZkXaT47C2EpitCN+

    Score
    10/10
    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Tasks