Analysis
-
max time kernel
121s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20231221-en -
resource tags
-
submitted
12-02-2024 02:06
General
-
Target
10686a12b7241a0836db6501a130ab67c7b38dbd583ccd39c9e655096695932e.elf
-
Size
34KB
-
MD5
5f983a94507abae4f188054b7b2e55ec
-
SHA1
801b0f681971ef167dfbc6d5d5d32fc07228241d
-
SHA256
10686a12b7241a0836db6501a130ab67c7b38dbd583ccd39c9e655096695932e
-
SHA512
5f4972d4602fff05c0c1e5a525140193af3e24069ff5b505cc9dc503fdddbe194760984e91c80271002f97bf0b2003d248bb081ea39beb0ea2d0aac1ca307f58
-
SSDEEP
768:90EQrTzqfaGaoWSfwu8tobYY5iSUnfpPEz+Qulu7BJgGlzDpbuR1JwH:90HrTzqhaoWSou8tDYYZqS6VJu+
Malware Config
Extracted
mirai
MIRAI
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (70613) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
-
Deletes itself 1 IoCs
-
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Deletes log files 1 TTPs 1 IoCs
Deletes log files on the system.
Processes
-
/tmp/10686a12b7241a0836db6501a130ab67c7b38dbd583ccd39c9e655096695932e.elf/tmp/10686a12b7241a0836db6501a130ab67c7b38dbd583ccd39c9e655096695932e.elf1⤵
- Changes its process name
- Deletes itself
- Modifies Watchdog functionality