mirai | 754109c1e57f8afae30f696d3ac6547d9df6341f6250b9b6d1e0cca0b0e25ee6

Analysis

max time kernel
0s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10-04-2024 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fad75956d7884a937c2c0ddc4d177ffc.elf
Size

24KB
MD5

fad75956d7884a937c2c0ddc4d177ffc
SHA1

4615c2f330ee57ae005b29932c32d90e2debff1d
SHA256

754109c1e57f8afae30f696d3ac6547d9df6341f6250b9b6d1e0cca0b0e25ee6
SHA512

0b979e230aceeeb5441493a0b87524a6a791d5d5ec9bb867d47375392fd36f74323a8913be3d858718fe23014c3296a6ef4f037e79fe948ac871109add2cac7f
SSDEEP

384:MXYwdbjcsRFyzxCbxn6NNW3JDTxMOTJ3vOwAU+5p5WfQbCTEokupXG+Qr1GvtIqY:IYIbosXwYU2ZHhlcUK5bbqTXTlK

Score

10^/10

mirai mirai botnet

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Deletes itself 1 IoCs

Processes:

fad75956d7884a937c2c0ddc4d177ffc.elf

pid process

1578 fad75956d7884a937c2c0ddc4d177ffc.elf

pid	process
1578	fad75956d7884a937c2c0ddc4d177ffc.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

fad75956d7884a937c2c0ddc4d177ffc.elf

description	ioc	process
File opened for modification	/dev/watchdog	fad75956d7884a937c2c0ddc4d177ffc.elf
File opened for modification	/dev/misc/watchdog	fad75956d7884a937c2c0ddc4d177ffc.elf

/tmp/fad75956d7884a937c2c0ddc4d177ffc.elf
/tmp/fad75956d7884a937c2c0ddc4d177ffc.elf
1⤵
- Deletes itself
- Modifies Watchdog functionality
PID:1578

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1578-1-0x0000000008048000-0x0000000008054700-memory.dmp

Download