General

  • Target

    0d8a1b83dbf03eccd21cf45dbdca7a1a.elf

  • Size

    20KB

  • Sample

    230511-gm1rbsdg9y

  • MD5

    0d8a1b83dbf03eccd21cf45dbdca7a1a

  • SHA1

    fbe1a3fa53c06db4b9bc1310c05e49ccad7de10b

  • SHA256

    4f483ba395bf1b6989401f9efcd2d4d24ef881cb8edc74bf351db2e406b896a5

  • SHA512

    4765b5eb8b525bdb9ea8f750783f7a9740ddcd0d3a189b64d5788baa1024c574e41b286357a98249b95d421cf8611ae82d70d3dfc6f7e09b8151ab208d26a694

  • SSDEEP

    384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtJHSyp:O98o08kxofBE+ZkXaT47C2EpitJNp

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      0d8a1b83dbf03eccd21cf45dbdca7a1a.elf

    • Size

      20KB

    • MD5

      0d8a1b83dbf03eccd21cf45dbdca7a1a

    • SHA1

      fbe1a3fa53c06db4b9bc1310c05e49ccad7de10b

    • SHA256

      4f483ba395bf1b6989401f9efcd2d4d24ef881cb8edc74bf351db2e406b896a5

    • SHA512

      4765b5eb8b525bdb9ea8f750783f7a9740ddcd0d3a189b64d5788baa1024c574e41b286357a98249b95d421cf8611ae82d70d3dfc6f7e09b8151ab208d26a694

    • SSDEEP

      384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtJHSyp:O98o08kxofBE+ZkXaT47C2EpitJNp

    Score
    10/10
    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Tasks