Overview

overview

10

Static

static

7

c3c5c5131e...61.elf

debian-9-armhf

10

Analysis

  • max time kernel
    149s
  • max time network
    11s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240226-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    05-04-2024 12:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c3c5c5131e0bacbd76d7a4d6f28f7061.elf

  • Size

    45KB

  • MD5

    c3c5c5131e0bacbd76d7a4d6f28f7061

  • SHA1

    a2fcf7cc251c3d23c3a9c0cf8aeca1dd4b6fddc1

  • SHA256

    a31355f0dfd026771870031fcf1e3d067184e1b0dfad03e3b075906438048d96

  • SHA512

    4644f369dcefe17b7b36e23380ebc7834fa4667260a9ab4093d2466b89c8443a29b2a74ae65f8a64a25abfd309c115cd963ca0b91e606920924cb5ff24a81d24

  • SSDEEP

    768:g/TYCoIxdEk+AxoTZAZHFeq8b3UF9q3UELbUXfi6nVMQHI4vcGpvG:gECFd+A6YHAxlLRQZG

Score
10/10
mirailzrdbotnet

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 1 TTPs 2 IoCs
  • Reads runtime system information 41 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/c3c5c5131e0bacbd76d7a4d6f28f7061.elf
    /tmp/c3c5c5131e0bacbd76d7a4d6f28f7061.elf
    1⤵
    • Reads runtime system information
    PID:644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/644-1-0x00008000-0x00026464-memory.dmp

    Download