mirai | 6530f1b48746f714c27381d1e0c18f7578310a42f4feba0acee5f92423582c35

Analysis

max time kernel
1s
platform
linux_mips
resource
debian9-mipsbe-en-20211208
resource tags

arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
04/07/2023, 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a3a8bcf36dda226c3e791cda99d7cf7d72e1fe369a6af35692c9df27ebdc281.elf
Size

36KB
MD5

c798711c234a6ea73390e2eb818c519a
SHA1

d0d6e08cb6b7f92794f16a15faa8691d825504f7
SHA256

4a3a8bcf36dda226c3e791cda99d7cf7d72e1fe369a6af35692c9df27ebdc281
SHA512

de12ec568ebb74a76b282ff5d36abd926dab408b965f3100afb43a1c4b727763a00cffcd0b93ab3792652199e72b1f7a6d0a65959947621e9f1f7595b5c3b12d
SSDEEP

768:49DfkC5yuCX0pzSTysHVFcJNhWVDRKZVyFEIIVgiMAJoiwvjsJgGlzDpbuR1Jb:49V5yuCXszST13oNI9KZIFdIWiMljkVI

Score

10^/10

mirai botnet

Malware Config

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc
File opened for reading	/proc/net/tcp

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
File opened for reading	/proc/net/tcp

/tmp/4a3a8bcf36dda226c3e791cda99d7cf7d72e1fe369a6af35692c9df27ebdc281.elf
/tmp/4a3a8bcf36dda226c3e791cda99d7cf7d72e1fe369a6af35692c9df27ebdc281.elf
1⤵
PID:325

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...