Analysis
-
max time kernel
149s -
max time network
148s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
21-02-2024 03:13
General
-
Target
3834a88651cf8d5302f28d30ca8adefa3c4a181edc08e0716d13d4ebb25f17f0.elf
-
Size
29KB
-
MD5
3b1a84de07c889721cc7578b4af128c8
-
SHA1
1671885698b090bcec516516c179d1f90905d53f
-
SHA256
3834a88651cf8d5302f28d30ca8adefa3c4a181edc08e0716d13d4ebb25f17f0
-
SHA512
27397619a8ef2d8395d86e19ede6bc7f87ebab6bedacce0713792358743140ba3b2db0ade4a656b709002f3ee28e0f540487d6e51611a663508aaeddadf78430
-
SSDEEP
768:I3wbd+LfaL4xHsSU6SZivnChiNRaoA46PTYn3llbzZa:Ig+s6SZ0Raoey39a
Malware Config
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Changes its process name 1 IoCs
-
Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
-
Deletes itself 1 IoCs
-
Deletes journal logs 1 TTPs 1 IoCs
Deletes systemd journal logs. Likely to evade detection.
-
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes
-
/tmp/3834a88651cf8d5302f28d30ca8adefa3c4a181edc08e0716d13d4ebb25f17f0.elf/tmp/3834a88651cf8d5302f28d30ca8adefa3c4a181edc08e0716d13d4ebb25f17f0.elf1⤵
- Changes its process name
- Deletes itself
- Modifies Watchdog functionality