mirai | 34e7056ef1d1cc0c6f32aac935134593c575177e3c3ccc5237b38373436c85c6 | Triage

Sharing

General

Target

9f320bb8dcbda1e0f6c44436704eb185.elf
Size

20KB
Sample

230525-1tbwbsdc2w
MD5

9f320bb8dcbda1e0f6c44436704eb185
SHA1

b6edfcf32608c1657c05f9979c75029ed60e7b02
SHA256

34e7056ef1d1cc0c6f32aac935134593c575177e3c3ccc5237b38373436c85c6
SHA512

ca833bb22c85645e9a6e6ac9445d50263efd559c82b7e2ad897bbd1b0ef927e790db7b67a40e05bea5930209d753e066838a09f90729f9165032ff87c1d4b51b
SSDEEP

384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTG:M98o08kxofBE+ZkXaITbp2F2TWul0c5C

Score

10^/10

mirai lzrd botnet linux upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

- Target
  
  9f320bb8dcbda1e0f6c44436704eb185.elf
- Size
  
  20KB
- MD5
  
  9f320bb8dcbda1e0f6c44436704eb185
- SHA1
  
  b6edfcf32608c1657c05f9979c75029ed60e7b02
- SHA256
  
  34e7056ef1d1cc0c6f32aac935134593c575177e3c3ccc5237b38373436c85c6
- SHA512
  
  ca833bb22c85645e9a6e6ac9445d50263efd559c82b7e2ad897bbd1b0ef927e790db7b67a40e05bea5930209d753e066838a09f90729f9165032ff87c1d4b51b
- SSDEEP
  
  384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTG:M98o08kxofBE+ZkXaITbp2F2TWul0c5C
Score

10^/10

mirai lzrd botnet
- Mirai
  Mirai is a prevalent Linux malware infecting exposed network devices.
  botnet mirai
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Impair Defenses

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

mirailzrdbotnet