mirai | ff20d9686565eaf9d5cadd3de9718cb89d164bb770a3ea1a1dbd6209a51e86a4 | Triage

Sharing

General

Target

SecuriteInfo.com.Linux.Siggen.9999.11042.24901.elf
Size

23KB
Sample

230529-w4babsdd7w
MD5

4cc4f8156edc35fa281527c9aea5bba1
SHA1

36ffb542dd3639adefef45a7bf38740599acf81b
SHA256

ff20d9686565eaf9d5cadd3de9718cb89d164bb770a3ea1a1dbd6209a51e86a4
SHA512

272e74d172b6ad4a49ea4005c307c0305f29d9112342419948c3962eb85822760e39cfbaa114415ed7b18e64d514661af6c8ed53e0edf14f3877ba5c4ee8b720
SSDEEP

384:a3WEBXfrIOPMQXWFgjmIzbJNWR4SAyV/3Aw+w1M7QbMcfJgGlzDpH7uNj1JSE:0x88MD6jXXWuOR+X7QbMGJgGlzDpbuRl

Score

10^/10

mirai lzrd botnet upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

- Target
  
  SecuriteInfo.com.Linux.Siggen.9999.11042.24901.elf
- Size
  
  23KB
- MD5
  
  4cc4f8156edc35fa281527c9aea5bba1
- SHA1
  
  36ffb542dd3639adefef45a7bf38740599acf81b
- SHA256
  
  ff20d9686565eaf9d5cadd3de9718cb89d164bb770a3ea1a1dbd6209a51e86a4
- SHA512
  
  272e74d172b6ad4a49ea4005c307c0305f29d9112342419948c3962eb85822760e39cfbaa114415ed7b18e64d514661af6c8ed53e0edf14f3877ba5c4ee8b720
- SSDEEP
  
  384:a3WEBXfrIOPMQXWFgjmIzbJNWR4SAyV/3Aw+w1M7QbMcfJgGlzDpH7uNj1JSE:0x88MD6jXXWuOR+X7QbMGJgGlzDpbuRl
Score

10^/10

mirai lzrd botnet
- Mirai
  Mirai is a prevalent Linux malware infecting exposed network devices.
  botnet mirai
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Impair Defenses

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

mirailzrdbotnet