mirai | e24ba8d78c3b37db40b7e77018e501de3b4fa1c1a9d26d260987a6f8bb823cfe | Triage

Sharing

General

Target

0f5d3275316cf58b05781dc5c523e312.bin
Size

20KB
Sample

240217-bcm5lahe3w
MD5

0f5d3275316cf58b05781dc5c523e312
SHA1

d1a9f2b3396940a9e3533c8412e7e71baef2eed0
SHA256

e24ba8d78c3b37db40b7e77018e501de3b4fa1c1a9d26d260987a6f8bb823cfe
SHA512

e4f8907966602740c4b169a9abb6ad7f3785db49dbe03c3d3405b8cdd2b4d8b2d19ee25b0cbdd5154034e310ebaaee1a34bd751075765e87511336eb6e058aec
SSDEEP

384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKE:M98o08kxofBE+ZkXaqGbp2F2TWul0c5p

Score

10^/10

mirai lzrd botnet linux upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

- Target
  
  0f5d3275316cf58b05781dc5c523e312.bin
- Size
  
  20KB
- MD5
  
  0f5d3275316cf58b05781dc5c523e312
- SHA1
  
  d1a9f2b3396940a9e3533c8412e7e71baef2eed0
- SHA256
  
  e24ba8d78c3b37db40b7e77018e501de3b4fa1c1a9d26d260987a6f8bb823cfe
- SHA512
  
  e4f8907966602740c4b169a9abb6ad7f3785db49dbe03c3d3405b8cdd2b4d8b2d19ee25b0cbdd5154034e310ebaaee1a34bd751075765e87511336eb6e058aec
- SSDEEP
  
  384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKE:M98o08kxofBE+ZkXaqGbp2F2TWul0c5p
Score

10^/10

mirai lzrd botnet
- Mirai
  Mirai is a prevalent Linux malware infecting exposed network devices.
  botnet mirai
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Enumerates running processes
  Discovers information about currently running processes on the system
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Impair Defenses

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

mirailzrdbotnet