mirai | 1238f79d962d841863896016ce24929b2cee22f9e2173f0e2d3667de591bcc7c | Triage

Sharing

General

Target

a3e6859e5e20538662eb1c31db59ec0a.elf
Size

24KB
Sample

230512-nzm5bsch93
MD5

a3e6859e5e20538662eb1c31db59ec0a
SHA1

548c4d09742126654eff1aac2b696fd7aa0aad23
SHA256

1238f79d962d841863896016ce24929b2cee22f9e2173f0e2d3667de591bcc7c
SHA512

78b79233227d067b9c75fbbe7465af56393428f29a55b79f1f327095230f3914332f94db33a02c5d8ffd140838591372e51236a4741bde7d6cf929aa7e1f3729
SSDEEP

768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpAZqSWv6:4QlS07FUXqIYSXQKquYqS

Score

10^/10

mirai lzrd botnet upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

- Target
  
  a3e6859e5e20538662eb1c31db59ec0a.elf
- Size
  
  24KB
- MD5
  
  a3e6859e5e20538662eb1c31db59ec0a
- SHA1
  
  548c4d09742126654eff1aac2b696fd7aa0aad23
- SHA256
  
  1238f79d962d841863896016ce24929b2cee22f9e2173f0e2d3667de591bcc7c
- SHA512
  
  78b79233227d067b9c75fbbe7465af56393428f29a55b79f1f327095230f3914332f94db33a02c5d8ffd140838591372e51236a4741bde7d6cf929aa7e1f3729
- SSDEEP
  
  768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpAZqSWv6:4QlS07FUXqIYSXQKquYqS
Score

10^/10

mirai lzrd botnet
- Mirai
  Mirai is a prevalent Linux malware infecting exposed network devices.
  botnet mirai
- Modifies the Watchdog daemon
  Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Impair Defenses

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

mirailzrdbotnet