mirai | e4205db7452d754076dbccf684ce5394fae2eb05fde666f6b2e5cb75e659abae

Analysis

max time kernel
147s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
03-06-2023 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x86.elf
Size

16KB
MD5

e4261dfc69029ca48d6767311e529a17
SHA1

16b231e12a0e3e57fa10b20a7d395cb954af7247
SHA256

e4205db7452d754076dbccf684ce5394fae2eb05fde666f6b2e5cb75e659abae
SHA512

0d8639d5d3a0772060d53d798243e07454c96716710e3eedf5ac8096ce3a902431154eaea8bfeac8f6f8f665b1c140f9aedd0b481100b9a64899aa31fae8db84
SSDEEP

384:Mwmhf5PCo2xLs5t/p1J5NE91BY89cm07YqDKxG:oxPymB7fK/C7Y4KxG

Score

10^/10

mirai botnet

Malware Config

Extracted

Family

mirai

193.35.18.42

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Changes its process name 1 IoCs

Processes:

x86.elf

description ioc pid process

Changes the process name, possibly in an attempt to hide itself a 599 x86.elf
Enumerates running processes
Discovers information about currently running processes on the system

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	a	599	x86.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

x86.elf

description	ioc
File opened for reading	/proc/346/cmdline
File opened for reading	/proc/594/cmdline
File opened for reading	/proc/22/cmdline
File opened for reading	/proc/24/cmdline
File opened for reading	/proc/31/cmdline
File opened for reading	/proc/34/cmdline
File opened for reading	/proc/80/cmdline
File opened for reading	/proc/171/cmdline
File opened for reading	/proc/599/cmdline
File opened for reading	/proc/10/cmdline
File opened for reading	/proc/15/cmdline
File opened for reading	/proc/21/cmdline
File opened for reading	/proc/27/cmdline
File opened for reading	/proc/166/cmdline
File opened for reading	/proc/182/cmdline
File opened for reading	/proc/596/cmdline
File opened for reading	/proc/4/cmdline
File opened for reading	/proc/7/cmdline
File opened for reading	/proc/167/cmdline
File opened for reading	/proc/180/cmdline
File opened for reading	/proc/362/cmdline
File opened for reading	/proc/364/cmdline
File opened for reading	/proc/8/cmdline
File opened for reading	/proc/17/cmdline
File opened for reading	/proc/175/cmdline
File opened for reading	/proc/177/cmdline
File opened for reading	/proc/305/cmdline
File opened for reading	/proc/82/cmdline
File opened for reading	/proc/98/cmdline
File opened for reading	/proc/2/cmdline
File opened for reading	/proc/11/cmdline
File opened for reading	/proc/23/cmdline
File opened for reading	/proc/28/cmdline
File opened for reading	/proc/32/cmdline
File opened for reading	/proc/35/cmdline
File opened for reading	/proc/176/cmdline
File opened for reading	/proc/568/cmdline
File opened for reading	/proc/588/cmdline
File opened for reading	/proc/1/cmdline
File opened for reading	/proc/29/cmdline
File opened for reading	/proc/30/cmdline
File opened for reading	/proc/254/cmdline
File opened for reading	/proc/602/cmdline
File opened for reading	/proc/5/cmdline
File opened for reading	/proc/16/cmdline
File opened for reading	/proc/165/cmdline
File opened for reading	/proc/14/cmdline
File opened for reading	/proc/83/cmdline
File opened for reading	/proc/115/cmdline
File opened for reading	/proc/178/cmdline
File opened for reading	/proc/351/cmdline
File opened for reading	/proc/381/cmdline
File opened for reading	/proc/self/exe	x86.elf
File opened for reading	/proc/18/cmdline
File opened for reading	/proc/129/cmdline
File opened for reading	/proc/170/cmdline
File opened for reading	/proc/304/cmdline
File opened for reading	/proc/432/cmdline
File opened for reading	/proc/3/cmdline
File opened for reading	/proc/78/cmdline
File opened for reading	/proc/84/cmdline
File opened for reading	/proc/168/cmdline
File opened for reading	/proc/174/cmdline
File opened for reading	/proc/204/cmdline

/tmp/x86.elf
/tmp/x86.elf
1⤵
- Changes its process name
- Reads runtime system information
PID:599

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads