Analysis

  • max time kernel
    149s
  • max time network
    6s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240226-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    11-04-2024 01:12

General

  • Target

    3de9a6c4ec9731408c65bcae040263fc955928a7b542c7f4515f4aa37530829d.elf

  • Size

    45KB

  • MD5

    c2405d5b7e609c9cfbca86434e308ed6

  • SHA1

    8f89ca073e422d4a66a0269607458695f7067b52

  • SHA256

    3de9a6c4ec9731408c65bcae040263fc955928a7b542c7f4515f4aa37530829d

  • SHA512

    356327cfffb476be32f679228f220b16135bd2c069ef3b9d1259471275742a87adb0ec2fd6c06d623378d7c7693850027fa0101c221cb8caff1e6be5d972be58

  • SSDEEP

    768:D/TYCoIxdEk+AxoTZAZHFeq8b3K9q3UELbUXfi6nVMQHI4vcGpvN:DECFd+A6YHAx/LRQZN

Score
10/10

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 1 TTPs 2 IoCs
  • Reads runtime system information 32 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/3de9a6c4ec9731408c65bcae040263fc955928a7b542c7f4515f4aa37530829d.elf
    /tmp/3de9a6c4ec9731408c65bcae040263fc955928a7b542c7f4515f4aa37530829d.elf
    1⤵
    • Reads runtime system information
    PID:639

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/639-1-0x00008000-0x00026464-memory.dmp