mirai | 4e2c5513cf1c4a3c12c6e108d0120d57355b3411c30d59dfb0d263ad932b6868

Analysis

max time kernel
154s
max time network
157s
platform
debian-9_armhf
resource
debian9-armhf-20231215-en
resource tags

arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/02/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e2c5513cf1c4a3c12c6e108d0120d57355b3411c30d59dfb0d263ad932b6868.elf
Size

58KB
MD5

60b10da752b888d644e650933a3379f2
SHA1

3ed6c0b972869da6273757f3f1c94d8d351d11dc
SHA256

4e2c5513cf1c4a3c12c6e108d0120d57355b3411c30d59dfb0d263ad932b6868
SHA512

002a6e7f6c4d909056cc51e227fcc8c776ccad9d1e600513a83ce4876cd035bb12f129ca3a1a48d21d76bd654058c19af55fe3d3a66186786779dc8bf4df8e4b
SSDEEP

1536:vPsS3RDMckLByMgLGohIovgh5/CLNh4Mt/hr25eg2:vPsSBDMcnxzQh5qLNhH3K5S

Score

10^/10

mirai mirai botnet discovery

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (60896) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	dki5t5gl2csctb1taj2lena0kduepnwq	678	4e2c5513cf1c4a3c12c6e108d0120d57355b3411c30d59dfb0d263ad932b6868.elf

Deletes itself 1 IoCs

pid	Process
678	4e2c5513cf1c4a3c12c6e108d0120d57355b3411c30d59dfb0d263ad932b6868.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	4e2c5513cf1c4a3c12c6e108d0120d57355b3411c30d59dfb0d263ad932b6868.elf
File opened for modification	/dev/misc/watchdog	4e2c5513cf1c4a3c12c6e108d0120d57355b3411c30d59dfb0d263ad932b6868.elf

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/exe	4e2c5513cf1c4a3c12c6e108d0120d57355b3411c30d59dfb0d263ad932b6868.elf

/tmp/4e2c5513cf1c4a3c12c6e108d0120d57355b3411c30d59dfb0d263ad932b6868.elf
/tmp/4e2c5513cf1c4a3c12c6e108d0120d57355b3411c30d59dfb0d263ad932b6868.elf
1⤵
- Changes its process name
- Deletes itself
- Modifies Watchdog functionality
- Reads runtime system information
PID:678

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads