mirai | 4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8

Analysis

max time kernel
150s
max time network
132s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
11-04-2024 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8.elf
Size

27KB
MD5

31b74ed3e433e0303b277c9b3d809d40
SHA1

24034505816acdd70ddd764a247d8c0dc01fbf97
SHA256

4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8
SHA512

4009a13546c89c9cef2d7cfe8c02d35ced269fdc7ffe0bae2959daac50b373be5ac4888b43ef445f5131dca563ad3205017245fe975566bbcbd451f8c9b7ab22
SSDEEP

768:1lbgA6jGCCuJAN6XK/tJvbKHCae6J0TnPWY:B6jUuAjaCl6J0Tt

Score

10^/10

mirai mirai botnet

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Changes its process name 1 IoCs

Processes:

4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	7tfcniunp8v7ccl8075vlod7of3j	714	4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8.elf

Deletes itself 1 IoCs

Processes:

4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8.elf

pid process

714 4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8.elf

pid	process
714	4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8.elf

description	ioc	process
File opened for modification	/dev/watchdog	4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8.elf
File opened for modification	/dev/misc/watchdog	4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

description ioc

File opened for reading /proc/net/tcp
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

description ioc

File opened for reading /proc/net/tcp

description	ioc
File opened for reading	/proc/net/tcp

description	ioc
File opened for reading	/proc/net/tcp

Reads runtime system information 15 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
File opened for reading	/proc/684/exe
File opened for reading	/proc/688/exe
File opened for reading	/proc/713/exe
File opened for reading	/proc/777/exe
File opened for reading	/proc/716/exe
File opened for reading	/proc/441/exe
File opened for reading	/proc/678/exe
File opened for reading	/proc/709/exe
File opened for reading	/proc/773/exe
File opened for reading	/proc/785/exe
File opened for reading	/proc/682/exe
File opened for reading	/proc/689/exe
File opened for reading	/proc/706/exe
File opened for reading	/proc/712/exe
File opened for reading	/proc/719/exe

/tmp/4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8.elf
/tmp/4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8.elf
1⤵
- Changes its process name
- Deletes itself
- Modifies Watchdog functionality
PID:714

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Connections Discovery

T1049

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/714-1-0x00400000-0x00451838-memory.dmp

Download