mirai | ce7f4b8f40a1fc3fb3dac5362aee57dfcffafbcc5037825333dd77caf3109dce | Triage

Sharing

General

Target

1b513fea29e61cfc0c855df16f92f152.bin
Size

20KB
Sample

230521-bgdrqaab6s
MD5

639a20c5456109098afbaf930c854566
SHA1

753d8ca58df570b815d40eae3d791cedcd2ed430
SHA256

ce7f4b8f40a1fc3fb3dac5362aee57dfcffafbcc5037825333dd77caf3109dce
SHA512

9cd1c2e0570b49b8a30d38f80b85bc3724b70a94088af52cf6e3ddce4726a5b5931362b40e76e9eabe60c2118d526a0e47339a90fc245eea7348642535f9e41b
SSDEEP

384:mFB1EMdg2er81KyL/00VY2T10FpXQv8Fb+F7/qb5oNrjf9fRR:+B1EMK2er8tw0BkSv8FCpqb5uvl

Score

10^/10

mirai lzrd botnet linux upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

- Target
  
  b6c075cf7afb6189764c59ed02dfa9b520127adcda048964c0985f451b84dc0a.elf
- Size
  
  20KB
- MD5
  
  1b513fea29e61cfc0c855df16f92f152
- SHA1
  
  f56e5847f98b44b3706576e8270173bfadc5f404
- SHA256
  
  b6c075cf7afb6189764c59ed02dfa9b520127adcda048964c0985f451b84dc0a
- SHA512
  
  fb81084faf9dda3f8329ac855bb0bf8da6da31efef62ed634238aded7f4e1405f9c23fc0791347918fd5d4fd33e73dc70e67a823f465c49c6d52f2e567be8936
- SSDEEP
  
  384:M87Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZksavICMZDA5YqqUTwNIZT1n6Epl9zpj:R98o08kxofBE+ZksatoA5wUT1n6Ep3lv
Score

10^/10

mirai lzrd botnet
- Mirai
  Mirai is a prevalent Linux malware infecting exposed network devices.
  botnet mirai
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Impair Defenses

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

mirailzrdbotnet