mirai | caf577935671be92ac6d345a23f49168787250316edbe6ddccebdfbcdec385eb

Resubmissions

15-05-2023 18:20

230515-wy896sgg89 10

15-05-2023 18:17

230515-wxedeafc5x 10

Analysis

max time kernel
114s
max time network
131s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
15-05-2023 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ntop2
Size

18KB
MD5

49b55b5189424fa00c16d438cfcab0e1
SHA1

488e9f9035076250cea5e41119f41d63f25c474e
SHA256

caf577935671be92ac6d345a23f49168787250316edbe6ddccebdfbcdec385eb
SHA512

1e53a0a1a69faa2db102efba490020e9f3652b0f177ece69b0343522a1f082e5cd068ce16b3f8cd36e79745bdb20797420f73abefe8527d5be21a72a505a5ad0
SSDEEP

384:MWeHKBGXaLKbt3PSgArJK2dRQQeCPKlFYjKN399R5lBHcUexKXnUbeQLq51e:MQGXiuK902dRECPJeN9jlBHcUeA3Pe

Score

10^/10

mirai botnet

Malware Config

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562
Changes its process name 1 IoCs

Processes:

ntop2

description pid process

Changes the process name, possibly in an attempt to hide itself 575 ntop2
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

description ioc

File opened for reading /proc/net/tcp
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

description ioc

File opened for reading /proc/net/tcp

description	pid	process
Changes the process name, possibly in an attempt to hide itself	575	ntop2

description	ioc
File opened for reading	/proc/net/tcp

description	ioc
File opened for reading	/proc/net/tcp

Reads runtime system information 35 IoCs

Reads data from /proc virtual filesystem.

Processes:

ntop2

description	ioc
File opened for reading	/proc/251/fd
File opened for reading	/proc/370/fd
File opened for reading	/proc/570/fd
File opened for reading	/proc/self/exe	ntop2
File opened for reading	/proc/580/exe
File opened for reading	/proc/581/exe
File opened for reading	/proc/579/fd
File opened for reading	/proc/350/fd
File opened for reading	/proc/393/fd
File opened for reading	/proc/576/fd
File opened for reading	/proc/587/fd
File opened for reading	/proc/309/fd
File opened for reading	/proc/310/fd
File opened for reading	/proc/1/fd
File opened for reading	/proc/252/fd
File opened for reading	/proc/332/fd
File opened for reading	/proc/356/fd
File opened for reading	/proc/578/fd
File opened for reading	/proc/541/fd
File opened for reading	/proc/579/exe
File opened for reading	/proc/422/exe
File opened for reading	/proc/342/fd
File opened for reading	/proc/363/fd
File opened for reading	/proc/394/fd
File opened for reading	/proc/422/fd
File opened for reading	/proc/576/exe
File opened for reading	/proc/570/exe
File opened for reading	/proc/238/fd
File opened for reading	/proc/334/fd
File opened for reading	/proc/349/fd
File opened for reading	/proc/541/exe
File opened for reading	/proc/571/exe
File opened for reading	/proc/572/exe
File opened for reading	/proc/573/exe
File opened for reading	/proc/347/fd

/tmp/ntop2
/tmp/ntop2
1⤵
- Changes its process name
- Reads runtime system information
PID:575

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/575-1-0x0000000008048000-0x00000000080536e0-memory.dmp

Download