mirai | ff4f238f867f32dc40fa6b82606604fe8237f5629e48a950fe479ef9033b61d4

Analysis

max time kernel
155s
max time network
132s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
12-02-2024 05:04

Target

ff4f238f867f32dc40fa6b82606604fe8237f5629e48a950fe479ef9033b61d4.elf
Size

33KB
MD5

1c1bf049a679bd582481693e1aeaaf4c
SHA1

d738ce09088eb550570931b25d886f9d080b1d36
SHA256

ff4f238f867f32dc40fa6b82606604fe8237f5629e48a950fe479ef9033b61d4
SHA512

a83e5774ff2190aa6a366de8b821e2bd5d4546a76689eb847f379fad5d7ff547d2a41f77b650235614dd3a725e41bbefcbe697cb13055622137b22d8458162c6
SSDEEP

768:KJRx8bDP5l5QA3oy3iDIfLfMebcpJ5MI/IHxoArpG3azKL:KJRxSPLYy3/Tcz2I/UrpG3azQ

Score

10^/10

mirai botnet botnet

Family

mirai

Botnet

BOTNET

scan.rebirthltd.top

194.169.175.3

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/usr/bin/dbus-daemon	1554	ff4f238f867f32dc40fa6b82606604fe8237f5629e48a950fe479ef9033b61d4.elf

Deletes itself 1 IoCs

pid	Process
1554	ff4f238f867f32dc40fa6b82606604fe8237f5629e48a950fe479ef9033b61d4.elf

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/exe	ff4f238f867f32dc40fa6b82606604fe8237f5629e48a950fe479ef9033b61d4.elf
File opened for reading	/proc/1524/fd	Process not Found