Overview

overview

10

Static

static

7

37abd9ae1c...d1.elf

ubuntu-18.04-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    37abd9ae1ce97738f9e0b116d887603f5533863cac6b881dd048445b1f96d1d1.elf

  • Size

    20KB

  • Sample

    240326-ck2hmabg22

  • MD5

    00940a6466ffdd660a5cfceec98a74d8

  • SHA1

    9673c3ab07684916584fdbce3b5dc4e1e5645533

  • SHA256

    37abd9ae1ce97738f9e0b116d887603f5533863cac6b881dd048445b1f96d1d1

  • SHA512

    aedff14a60291146b8e3c18751459c501f3851e42728eccb5cd48a775b6e8c769100bb5798c4c739ce6b9027c18078cb9edc335cb948ee2493599d6e25b3422e

  • SSDEEP

    384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAK5:x98o08kxofBE+ZkXaqGbp2F2TWul0c5M

Score
10/10
mirailzrdbotnetlinuxupx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      37abd9ae1ce97738f9e0b116d887603f5533863cac6b881dd048445b1f96d1d1.elf

    • Size

      20KB

    • MD5

      00940a6466ffdd660a5cfceec98a74d8

    • SHA1

      9673c3ab07684916584fdbce3b5dc4e1e5645533

    • SHA256

      37abd9ae1ce97738f9e0b116d887603f5533863cac6b881dd048445b1f96d1d1

    • SHA512

      aedff14a60291146b8e3c18751459c501f3851e42728eccb5cd48a775b6e8c769100bb5798c4c739ce6b9027c18078cb9edc335cb948ee2493599d6e25b3422e

    • SSDEEP

      384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAK5:x98o08kxofBE+ZkXaqGbp2F2TWul0c5M

    Score
    10/10
    mirailzrdbotnet

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks