General

  • Target

    boatnet.x86-20230501-1150.elf

  • Size

    20KB

  • Sample

    230501-nz5pdahb7x

  • MD5

    eaf74a5c6e9fe44feef9dec729cb05dc

  • SHA1

    9bc01050f219098adc2f355213c20a5c428ad995

  • SHA256

    b8af262c902218e0f77af583a1d51f9952e4b417059bc51f7484fc8db7499232

  • SHA512

    62b7db09bdb78c13d3cf69d7a7064c742e237fdaba7468df53a550a9b9d0cd56aa1bb7f2271236fd9e87a4a8dda50ce9058a8dcd93e30641a18c2f1833738313

  • SSDEEP

    384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTg:x98o08kxofBE+ZkXaEbp2F2TWul0c5Qt

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      boatnet.x86-20230501-1150.elf

    • Size

      20KB

    • MD5

      eaf74a5c6e9fe44feef9dec729cb05dc

    • SHA1

      9bc01050f219098adc2f355213c20a5c428ad995

    • SHA256

      b8af262c902218e0f77af583a1d51f9952e4b417059bc51f7484fc8db7499232

    • SHA512

      62b7db09bdb78c13d3cf69d7a7064c742e237fdaba7468df53a550a9b9d0cd56aa1bb7f2271236fd9e87a4a8dda50ce9058a8dcd93e30641a18c2f1833738313

    • SSDEEP

      384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTg:x98o08kxofBE+ZkXaEbp2F2TWul0c5Qt

    Score
    10/10
    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Tasks