Analysis
-
max time kernel
150s -
max time network
132s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240226-en -
resource tags
-
submitted
11-04-2024 01:13
General
-
Target
4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8.elf
-
Size
27KB
-
MD5
31b74ed3e433e0303b277c9b3d809d40
-
SHA1
24034505816acdd70ddd764a247d8c0dc01fbf97
-
SHA256
4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8
-
SHA512
4009a13546c89c9cef2d7cfe8c02d35ced269fdc7ffe0bae2959daac50b373be5ac4888b43ef445f5131dca563ad3205017245fe975566bbcbd451f8c9b7ab22
-
SSDEEP
768:1lbgA6jGCCuJAN6XK/tJvbKHCae6J0TnPWY:B6jUuAjaCl6J0Tt
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
MIRAI
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Changes its process name 1 IoCs
-
Deletes itself 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 15 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8.elf/tmp/4413f87b76e7b3c733adee744e0640029de48531a42d7ba2f0f76ee1ddd05bd8.elf1⤵
- Changes its process name
- Deletes itself
- Modifies Watchdog functionality