Analysis
-
max time kernel
149s -
max time network
148s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240226-en -
resource tags
-
submitted
03-04-2024 01:15
General
-
Target
a6c1a94828b01c0aacd96159919d36031dc10713a00da54945dca3676f1036be.elf
-
Size
35KB
-
MD5
4808a808fec25b07e9e28b0238e0ba4a
-
SHA1
d3c97161ae9ed8f0d926439a3ae42d48f962d726
-
SHA256
a6c1a94828b01c0aacd96159919d36031dc10713a00da54945dca3676f1036be
-
SHA512
61e9613881baa8667f0c7ea7858944b629af24c021ba9b15a22a1b1290cb57b71d59ee4aa14bfea1263989e57f8d4668cfad368350c686b4d1783c973c33eab6
-
SSDEEP
768:PailI++SHdh9D+NWkWej0/RJkCWk9uqmVwv5sfDWy:Jl+SH9D+NW3e0wk9uqmVwhsX
Malware Config
Extracted
mirai
MIRAI
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Changes its process name 1 IoCs
-
Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
-
Deletes itself 1 IoCs
-
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Deletes log files 1 TTPs 2 IoCs
Deletes log files on the system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/a6c1a94828b01c0aacd96159919d36031dc10713a00da54945dca3676f1036be.elf/tmp/a6c1a94828b01c0aacd96159919d36031dc10713a00da54945dca3676f1036be.elf1⤵
- Changes its process name
- Deletes itself
- Modifies Watchdog functionality