General

  • Target

    boatnet.x86.elf

  • Size

    20KB

  • Sample

    230514-kcemwsde71

  • MD5

    3be4c48159951b14311c8dbf861acb57

  • SHA1

    328b958bbe35d3f3a1a0f54c7082e60f46213ded

  • SHA256

    3495c9a42b188b501d941d80d90d675e53d10cf9048f257d5c96cd8287a0b310

  • SHA512

    804076dca985f3989074be5a6981a557b114ebccb0bacbbc3883c417b7e38f64e4527bc8002fdf9217d947a0bc6d04b8e80cb80e1bae68dbf0890bd5ed6085b1

  • SSDEEP

    384:M0hLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXa2UbDib+502F2vwA9B1fKVVXC6Sya:T98o08kxofBE+ZkXaXDibp2F2n8VVXCN

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      boatnet.x86.elf

    • Size

      20KB

    • MD5

      3be4c48159951b14311c8dbf861acb57

    • SHA1

      328b958bbe35d3f3a1a0f54c7082e60f46213ded

    • SHA256

      3495c9a42b188b501d941d80d90d675e53d10cf9048f257d5c96cd8287a0b310

    • SHA512

      804076dca985f3989074be5a6981a557b114ebccb0bacbbc3883c417b7e38f64e4527bc8002fdf9217d947a0bc6d04b8e80cb80e1bae68dbf0890bd5ed6085b1

    • SSDEEP

      384:M0hLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXa2UbDib+502F2vwA9B1fKVVXC6Sya:T98o08kxofBE+ZkXaXDibp2F2n8VVXCN

    Score
    10/10
    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Tasks