mirai | 159acf9dac405bc4087753c001694f143b2167e10880c10749eaa2b90f293a1e

Analysis

max time kernel
149s
max time network
131s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
11-03-2024 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

159acf9dac405bc4087753c001694f143b2167e10880c10749eaa2b90f293a1e.elf
Size

21KB
MD5

d5090bfb4c171c6aa9cd433283274b6d
SHA1

f1a838c25a5ce0eb4f2eddaae477abb0b09411a5
SHA256

159acf9dac405bc4087753c001694f143b2167e10880c10749eaa2b90f293a1e
SHA512

958a12357949975e8b67f17816a38fc8f99f04865b958cc21ddcb3adefeae22a314efc0ccf2bed22bc52a5a8076f102bdc17b285192778830e6dbda69d685bc3
SSDEEP

384:MgnLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadEg6LFUamvF0jsyV3bh/mGWxdxSo:J98o08kxofBE+ZkXauk1KxlmGWxdf7

Score

10^/10

mirai lzrd botnet

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Processes:

description ioc

File opened for modification /dev/watchdog
File opened for modification /dev/misc/watchdog
Enumerates running processes
Discovers information about currently running processes on the system
Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow
T1574

Processes:

description ioc

File opened for modification /sbin/watchdog
File opened for modification /bin/watchdog

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

description	ioc
File opened for modification	/sbin/watchdog
File opened for modification	/bin/watchdog

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
File opened for reading	/proc/1620/cmdline
File opened for reading	/proc/1554/cmdline
File opened for reading	/proc/453/cmdline
File opened for reading	/proc/509/cmdline
File opened for reading	/proc/1023/cmdline
File opened for reading	/proc/1092/cmdline
File opened for reading	/proc/1157/cmdline
File opened for reading	/proc/1336/cmdline
File opened for reading	/proc/1432/cmdline
File opened for reading	/proc/1125/cmdline
File opened for reading	/proc/449/cmdline
File opened for reading	/proc/588/cmdline
File opened for reading	/proc/1060/cmdline
File opened for reading	/proc/1138/cmdline
File opened for reading	/proc/1146/cmdline
File opened for reading	/proc/438/cmdline
File opened for reading	/proc/1121/cmdline
File opened for reading	/proc/1143/cmdline
File opened for reading	/proc/1188/cmdline
File opened for reading	/proc/1307/cmdline
File opened for reading	/proc/1562/cmdline
File opened for reading	/proc/564/cmdline
File opened for reading	/proc/957/cmdline
File opened for reading	/proc/1179/cmdline
File opened for reading	/proc/1185/cmdline
File opened for reading	/proc/1556/cmdline
File opened for reading	/proc/1602/cmdline
File opened for reading	/proc/1644/cmdline
File opened for reading	/proc/1103/cmdline
File opened for reading	/proc/1180/cmdline
File opened for reading	/proc/1557/cmdline
File opened for reading	/proc/1037/cmdline
File opened for reading	/proc/1065/cmdline
File opened for reading	/proc/478/cmdline
File opened for reading	/proc/1063/cmdline
File opened for reading	/proc/402/cmdline
File opened for reading	/proc/669/cmdline
File opened for reading	/proc/953/cmdline
File opened for reading	/proc/1288/cmdline
File opened for reading	/proc/1289/cmdline
File opened for reading	/proc/454/cmdline
File opened for reading	/proc/632/cmdline
File opened for reading	/proc/1353/cmdline
File opened for reading	/proc/1083/cmdline
File opened for reading	/proc/1614/cmdline
File opened for reading	/proc/473/cmdline
File opened for reading	/proc/964/cmdline
File opened for reading	/proc/1147/cmdline
File opened for reading	/proc/1268/cmdline
File opened for reading	/proc/1350/cmdline
File opened for reading	/proc/1539/cmdline
File opened for reading	/proc/452/cmdline
File opened for reading	/proc/659/cmdline
File opened for reading	/proc/703/cmdline
File opened for reading	/proc/713/cmdline
File opened for reading	/proc/1155/cmdline
File opened for reading	/proc/1570/cmdline
File opened for reading	/proc/1590/cmdline
File opened for reading	/proc/1148/cmdline
File opened for reading	/proc/418/cmdline
File opened for reading	/proc/707/cmdline
File opened for reading	/proc/890/cmdline
File opened for reading	/proc/1133/cmdline
File opened for reading	/proc/1159/cmdline

/tmp/159acf9dac405bc4087753c001694f143b2167e10880c10749eaa2b90f293a1e.elf
/tmp/159acf9dac405bc4087753c001694f143b2167e10880c10749eaa2b90f293a1e.elf
1⤵
PID:1559

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Impair Defenses

T1562

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1559-1-0x0000000008048000-0x00000000080547a0-memory.dmp

Download