Analysis
-
max time kernel
154s -
max time network
155s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20230712-en -
resource tags
-
submitted
17-07-2023 12:51
General
-
Target
c375339e398fd39a5203e791e5c37f67.elf
-
Size
32KB
-
MD5
c375339e398fd39a5203e791e5c37f67
-
SHA1
6afd9fbc01eccd4dfcd972604e4e2cc0119b8243
-
SHA256
c1e5375ed9fadc54370de6cf7758de7323409f29a198287f5a1e4a15cd07ac00
-
SHA512
50a32af8b09fc45bb62c21298d527004350a8746843bce25e04174cf3a4da89a5e0142cb68c2277696b24558dc15e833ed836dd217f574b4a8652242b9da92e9
-
SSDEEP
768:uNyFa59wp6bs++1xqjENnqgVDTDcFCA+0yF65rVifnbcuyD7Uiyqu:ug05qMbsX4qnz1t0Ifnouy8Zqu
Malware Config
Extracted
mirai
UNSTABLE
testbots.maizhangyu.top
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (207298) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
-
Reads runtime system information 21 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/c375339e398fd39a5203e791e5c37f67.elf/tmp/c375339e398fd39a5203e791e5c37f67.elf1⤵
- Changes its process name
- Reads runtime system information