mirai | f48207c5812eb70fab56687451864e9aef4a9449faef076f4ca8a4eed877c78f

Analysis

max time kernel
2s
platform
debian-9_armhf
resource
debian9-armhf-20231215-en
resource tags

arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20/12/2023, 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a955e7e0b0eca1b631cb362ac5b1a346
Size

43KB
MD5

a955e7e0b0eca1b631cb362ac5b1a346
SHA1

3199b0e03e85e19025566cae6f642ef061b32185
SHA256

f48207c5812eb70fab56687451864e9aef4a9449faef076f4ca8a4eed877c78f
SHA512

d2598fdb12feed50c7b9926a4e992c2c6483499047e45945ead991f60f83cc0ba0594736b2da932b9a991288192f57d03d12d71aa202574d899aab248fc49570
SSDEEP

768:h/kCDUaK071lWfEUfSimKq+leDJzkcrb9IPxgwI9q3UELE4gtitqGv/TzqFzvIKw:hMCDTK071off8+a9TBIgwxLjLDTzMQKw

Score

10^/10

mirai debug botnet

Malware Config

Extracted

Family

mirai

Botnet

DEBUG

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Deletes itself 1 IoCs

pid	Process
650	a955e7e0b0eca1b631cb362ac5b1a346

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	a955e7e0b0eca1b631cb362ac5b1a346
File opened for modification	/dev/misc/watchdog	a955e7e0b0eca1b631cb362ac5b1a346

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/exe	a955e7e0b0eca1b631cb362ac5b1a346

/tmp/a955e7e0b0eca1b631cb362ac5b1a346
/tmp/a955e7e0b0eca1b631cb362ac5b1a346
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Reads runtime system information
PID:650

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...