mirai | 94aee539b699bfc91a247536ef9d7b3d365b56fb9988072fbb1e7538ab2f48b5

Analysis

max time kernel
152s
max time network
102s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02-05-2023 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3c9566e9977741079d3cc6f71cc2921be928e17df305bbe0c2d4cea142743e2.elf
Size

21KB
MD5

6e10f7141fc5bfe4560cd452ec0f4b2a
SHA1

eb0da94d39537297ae786191bc405ac476676ed6
SHA256

f3c9566e9977741079d3cc6f71cc2921be928e17df305bbe0c2d4cea142743e2
SHA512

b8d3ac11bc864b3dafd108d42f6a8e93ea268d5554aa67266694937e9e3b85efeb7fcaf38f279a18ba1f8aa1da5f5e96bd180ca362ca3464c41019ec527e64e9
SSDEEP

384:MOcDqRfKUWFH39z+/49ETVQrGLruI8qB+eANnlBQpMr/4oVk+v1Rph:zMkKJFH39CBVQey7qsZoMTTlph

Score

10^/10

mirai lzrd botnet

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562
Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow
T1574

Processes:

description ioc

File opened for modification /sbin/watchdog
File opened for modification /bin/watchdog

description	ioc
File opened for modification	/sbin/watchdog
File opened for modification	/bin/watchdog

Reads runtime system information 11 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
File opened for reading	/proc/588/cmdline
File opened for reading	/proc/589/cmdline
File opened for reading	/proc/417/cmdline
File opened for reading	/proc/423/cmdline
File opened for reading	/proc/581/cmdline
File opened for reading	/proc/582/cmdline
File opened for reading	/proc/583/cmdline
File opened for reading	/proc/425/cmdline
File opened for reading	/proc/451/cmdline
File opened for reading	/proc/453/cmdline
File opened for reading	/proc/580/cmdline

/tmp/f3c9566e9977741079d3cc6f71cc2921be928e17df305bbe0c2d4cea142743e2.elf
/tmp/f3c9566e9977741079d3cc6f71cc2921be928e17df305bbe0c2d4cea142743e2.elf
1⤵
PID:585

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Impair Defenses

T1562

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/585-1-0x0000000008048000-0x0000000008056c40-memory.dmp

Download