mirai | 48cd7492ee4b71bc4203dc06c6ed5e9b452fdee662ce21e6633ff07d4255fa72

Analysis

max time kernel
151s
max time network
152s
platform
debian-9_armhf
resource
debian9-armhf-20231222-en
resource tags

arch:armhfimage:debian9-armhf-20231222-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/02/2024, 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48cd7492ee4b71bc4203dc06c6ed5e9b452fdee662ce21e6633ff07d4255fa72.elf
Size

33KB
MD5

7604f9ccf0e615206f77f7438646c31d
SHA1

a60064e5bb7906a1ff70882d8465b23ccf76552b
SHA256

48cd7492ee4b71bc4203dc06c6ed5e9b452fdee662ce21e6633ff07d4255fa72
SHA512

46449ad2faf3231a92fa0172d2a6eb9e79acc236691e8b9748e540dfcd98e6faeda7a2468f349707a5317deec0be9520cce9d4a126f85e456060e0f2ff54c0a7
SSDEEP

768:t/AX49kYDJ9GPnoAr9ttMW4UwTK/8nVxr1xQdTIVRR7o3UC:GPno+CWcjn31xImRR7Y

Score

10^/10

mirai botnet discovery

Malware Config

Extracted

Family

mirai

scan.rebirthltd.top

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (76670) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/usr/bin/dbus-daemon	700	48cd7492ee4b71bc4203dc06c6ed5e9b452fdee662ce21e6633ff07d4255fa72.elf

Deletes itself 1 IoCs

pid	Process
700	48cd7492ee4b71bc4203dc06c6ed5e9b452fdee662ce21e6633ff07d4255fa72.elf

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/exe	48cd7492ee4b71bc4203dc06c6ed5e9b452fdee662ce21e6633ff07d4255fa72.elf
File opened for reading	/proc/703/fd	Process not Found

/tmp/48cd7492ee4b71bc4203dc06c6ed5e9b452fdee662ce21e6633ff07d4255fa72.elf
/tmp/48cd7492ee4b71bc4203dc06c6ed5e9b452fdee662ce21e6633ff07d4255fa72.elf
1⤵
- Changes its process name
- Deletes itself
- Reads runtime system information
PID:700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...