Analysis
-
max time kernel
150s -
max time network
150s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240226-en -
resource tags
-
submitted
03-04-2024 01:47
General
-
Target
ded0b3101d0cf256b0a87535dd5d006176c0aa59c023bfbd2c6eac4fc6f0d40b.elf
-
Size
34KB
-
MD5
bd3d9006bbf218921abe0aee33ac9052
-
SHA1
98a252a065accee829e6911a8bef0544cc1c8427
-
SHA256
ded0b3101d0cf256b0a87535dd5d006176c0aa59c023bfbd2c6eac4fc6f0d40b
-
SHA512
e15d88851f29bf459d998a9c912c407e88678d4de8e1910749cc03a4e4f1fe18f14c201f9993a8cf324beb9b50a2496092d401295bd0a2058717798b4fc527eb
-
SSDEEP
768:nmyOC2vN/YhN6hZjnmjdkFXAbirLAU+gTNZYYrZQPS4JgGlzDpbuR1JYy:mY2vON6Dj0aQ23AGTNvIS4VJuyy
Malware Config
Extracted
mirai
MIRAI
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Changes its process name 1 IoCs
-
Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
-
Deletes itself 1 IoCs
-
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Deletes log files 1 TTPs 1 IoCs
Deletes log files on the system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/ded0b3101d0cf256b0a87535dd5d006176c0aa59c023bfbd2c6eac4fc6f0d40b.elf/tmp/ded0b3101d0cf256b0a87535dd5d006176c0aa59c023bfbd2c6eac4fc6f0d40b.elf1⤵
- Changes its process name
- Deletes itself
- Modifies Watchdog functionality