Overview

overview

10

Static

static

7

3a1cce2d96...2f.elf

ubuntu-18.04-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3a1cce2d9626706f03e6523c0c6763defd4e25d0bd159ffb9b3636767adfd72f.elf

  • Size

    20KB

  • Sample

    240223-fphg4abd8w

  • MD5

    d68f7cb2f138a9922a05c55d8f3ca6b8

  • SHA1

    26be32b6c5e4dc976867e81291f6a217e25e8436

  • SHA256

    3a1cce2d9626706f03e6523c0c6763defd4e25d0bd159ffb9b3636767adfd72f

  • SHA512

    c7ac813fc780988404d03cc24fe2ec6fd3f4259fdc2e3cb99b4e6e58e3836ed3774fb2f881c33faa2b04abdabc1a425de543011e77c449dcb0ff0cc0e2620d10

  • SSDEEP

    384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTM:O98o08kxofBE+ZkXaITbp2F2TWul0c5g

Score
10/10
mirailzrdbotnetlinuxupx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      3a1cce2d9626706f03e6523c0c6763defd4e25d0bd159ffb9b3636767adfd72f.elf

    • Size

      20KB

    • MD5

      d68f7cb2f138a9922a05c55d8f3ca6b8

    • SHA1

      26be32b6c5e4dc976867e81291f6a217e25e8436

    • SHA256

      3a1cce2d9626706f03e6523c0c6763defd4e25d0bd159ffb9b3636767adfd72f

    • SHA512

      c7ac813fc780988404d03cc24fe2ec6fd3f4259fdc2e3cb99b4e6e58e3836ed3774fb2f881c33faa2b04abdabc1a425de543011e77c449dcb0ff0cc0e2620d10

    • SSDEEP

      384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTM:O98o08kxofBE+ZkXaITbp2F2TWul0c5g

    Score
    10/10
    mirailzrdbotnet

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks