mirai | 90ab3f638244a81e76748186aecad1ee0585e68042f29b481ab38b195c5ab85b

Analysis

max time kernel
153s
max time network
150s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
07/08/2023, 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91cb9b29004cc8c5496bc951b6eb13aa.elf
Size

30KB
MD5

91cb9b29004cc8c5496bc951b6eb13aa
SHA1

c8a9fd4c514d13fa3c4fef6d06c97ea5406de500
SHA256

90ab3f638244a81e76748186aecad1ee0585e68042f29b481ab38b195c5ab85b
SHA512

489f8e68e2d83223eb5157bb969bbc881f90b92e489250a8b3b57d06dcf32dd0b1111f05adfcc83ac931cfbc2244e84c36da440e1333904c9e5b494bacd078c3
SSDEEP

768:JvyXOqGqAWfcs+SAL4yUywcRjR6pSYU2PjW:JHqGM+SXyUyrkpSEjW

Score

10^/10

mirai botnet

Malware Config

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	91cb9b29004cc8c5496bc951b6eb13aa.elf
File opened for modification	/dev/misc/watchdog	91cb9b29004cc8c5496bc951b6eb13aa.elf

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/exe	91cb9b29004cc8c5496bc951b6eb13aa.elf

/tmp/91cb9b29004cc8c5496bc951b6eb13aa.elf
/tmp/91cb9b29004cc8c5496bc951b6eb13aa.elf
1⤵
- Modifies Watchdog functionality
- Reads runtime system information
PID:575

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...