mirai | 6bcbca5b237c20e2c247da0abe6b6d1a043ff9300c3d145b624de1b6a9e16af5

Resubmissions

10-05-2023 01:43

230510-b48wdaff7t 10

Analysis

max time kernel
1s
max time network
124s
platform
linux_armhf
resource
debian9-armhf-en-20211208
resource tags

arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10-05-2023 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bcbc739a4ef555025c9dff21e2159e2ee419cc19261133d162625a790abb4e9.elf
Size

50KB
MD5

79fa35fd863918e07234946d168c303a
SHA1

5bfb0a26eb26ed62548d1a1e8f5104617792c23f
SHA256

5bcbc739a4ef555025c9dff21e2159e2ee419cc19261133d162625a790abb4e9
SHA512

e9ecad9a1b39dde8dd678d6054e3480fb5f1d60d2acb77d6afebb613196ebe622676c65626a451d2af142f9a6e9a792a3893f6f0dd4b7eafacd6257b4489e932
SSDEEP

1536:1a8ZqK2kfJzQA37UsEiz6ILYwKeokllDi6:1HqK2kfX3jEIJLjb

Score

10^/10

mirai botnet botnet

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Changes its process name 1 IoCs

Processes:

5bcbc739a4ef555025c9dff21e2159e2ee419cc19261133d162625a790abb4e9.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	355	5bcbc739a4ef555025c9dff21e2159e2ee419cc19261133d162625a790abb4e9.elf

Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.

Processes:

5bcbc739a4ef555025c9dff21e2159e2ee419cc19261133d162625a790abb4e9.elf

description ioc process

File opened for reading /proc/self/exe 5bcbc739a4ef555025c9dff21e2159e2ee419cc19261133d162625a790abb4e9.elf

description	ioc	process
File opened for reading	/proc/self/exe	5bcbc739a4ef555025c9dff21e2159e2ee419cc19261133d162625a790abb4e9.elf

/tmp/5bcbc739a4ef555025c9dff21e2159e2ee419cc19261133d162625a790abb4e9.elf
/tmp/5bcbc739a4ef555025c9dff21e2159e2ee419cc19261133d162625a790abb4e9.elf
1⤵
- Changes its process name
- Reads runtime system information
PID:355

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/355-1-0x00008000-0x00028a98-memory.dmp

Download