mirai | ede2c7a460f62bc0da8a880d75937e5249295c1d154e08f88a9f9a6cb156a2cb

Analysis

max time kernel
152s
max time network
8s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
14-05-2023 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

475f28781e8d14d52788ef589bbb4f41049aa90c6dd1359927915431b2410f40.elf
Size

21KB
MD5

a90e415ff17734be20f1c6dc66964db8
SHA1

e4c6c2598161672c12d931588aaba534233d4426
SHA256

475f28781e8d14d52788ef589bbb4f41049aa90c6dd1359927915431b2410f40
SHA512

ab079e48c40b6a87c64a3a0097794c36dc1056b15fc43057da41339cf5c25b2089d7ae6cdbb1710dfc206454adc2ad44ef43f10a320c06666dcd1dadb3f13afc
SSDEEP

384:MOcDqRfKUWFH39z+/49ETVQrGLruI8qB+eANnlBQpMr//Ayk+v1RpA:zMkKJFH39CBVQey7qsZoMT4ypA

Score

10^/10

mirai lzrd botnet

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562
Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow
T1574

Processes:

description ioc

File opened for modification /sbin/watchdog
File opened for modification /bin/watchdog

description	ioc
File opened for modification	/sbin/watchdog
File opened for modification	/bin/watchdog

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
File opened for reading	/proc/412/cmdline
File opened for reading	/proc/595/cmdline
File opened for reading	/proc/596/cmdline
File opened for reading	/proc/603/cmdline
File opened for reading	/proc/424/cmdline
File opened for reading	/proc/427/cmdline
File opened for reading	/proc/447/cmdline
File opened for reading	/proc/450/cmdline
File opened for reading	/proc/576/cmdline
File opened for reading	/proc/594/cmdline
File opened for reading	/proc/597/cmdline
File opened for reading	/proc/602/cmdline

/tmp/475f28781e8d14d52788ef589bbb4f41049aa90c6dd1359927915431b2410f40.elf
/tmp/475f28781e8d14d52788ef589bbb4f41049aa90c6dd1359927915431b2410f40.elf
1⤵
PID:599

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Impair Defenses

T1562

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/599-1-0x0000000008048000-0x0000000008056c40-memory.dmp

Download