Analysis Overview
score
10/10
SHA256
b25fd94d5941b7737bf859904e05087be415c128e3148fc6c8a82cbc0184ded4
Threat Level: Known bad
The file 05f3c0e2c731be80a68df7e87856050a.elf was found to be: Known bad.
Malicious Activity Summary
Mirai family
Changes its process name
Deletes itself
Enumerates running processes
Reads runtime system information
MITRE ATT&CK
N/A
Analysis: static1
Detonation Overview
Reported
2024-04-14 15:23
Signatures
Mirai family
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-14 15:23
Reported
2024-04-14 15:25
Platform
ubuntu1804-amd64-20240226-en
Max time kernel
134s
Max time network
140s
Command Line
[/tmp/05f3c0e2c731be80a68df7e87856050a.elf]
Signatures
Changes its process name
| Description | Indicator | Process | Target |
| Changes the process name, possibly in an attempt to hide itself | httpd | /tmp/05f3c0e2c731be80a68df7e87856050a.elf | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Enumerates running processes
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/10/cmdline | N/A | N/A |
| File opened for reading | /proc/1136/cmdline | N/A | N/A |
| File opened for reading | /proc/14/cmdline | N/A | N/A |
| File opened for reading | /proc/24/cmdline | N/A | N/A |
| File opened for reading | /proc/546/cmdline | N/A | N/A |
| File opened for reading | /proc/950/cmdline | N/A | N/A |
| File opened for reading | /proc/1132/cmdline | N/A | N/A |
| File opened for reading | /proc/163/cmdline | N/A | N/A |
| File opened for reading | /proc/178/cmdline | N/A | N/A |
| File opened for reading | /proc/207/cmdline | N/A | N/A |
| File opened for reading | /proc/35/cmdline | N/A | N/A |
| File opened for reading | /proc/170/cmdline | N/A | N/A |
| File opened for reading | /proc/174/cmdline | N/A | N/A |
| File opened for reading | /proc/176/cmdline | N/A | N/A |
| File opened for reading | /proc/323/cmdline | N/A | N/A |
| File opened for reading | /proc/696/cmdline | N/A | N/A |
| File opened for reading | /proc/164/cmdline | N/A | N/A |
| File opened for reading | /proc/89/cmdline | N/A | N/A |
| File opened for reading | /proc/956/cmdline | N/A | N/A |
| File opened for reading | /proc/1106/cmdline | N/A | N/A |
| File opened for reading | /proc/1141/cmdline | N/A | N/A |
| File opened for reading | /proc/5/cmdline | N/A | N/A |
| File opened for reading | /proc/32/cmdline | N/A | N/A |
| File opened for reading | /proc/169/cmdline | N/A | N/A |
| File opened for reading | /proc/494/cmdline | N/A | N/A |
| File opened for reading | /proc/517/cmdline | N/A | N/A |
| File opened for reading | /proc/569/cmdline | N/A | N/A |
| File opened for reading | /proc/965/cmdline | N/A | N/A |
| File opened for reading | /proc/1065/cmdline | N/A | N/A |
| File opened for reading | /proc/1120/cmdline | N/A | N/A |
| File opened for reading | /proc/11/cmdline | N/A | N/A |
| File opened for reading | /proc/31/cmdline | N/A | N/A |
| File opened for reading | /proc/489/cmdline | N/A | N/A |
| File opened for reading | /proc/888/cmdline | N/A | N/A |
| File opened for reading | /proc/1087/cmdline | N/A | N/A |
| File opened for reading | /proc/1116/cmdline | N/A | N/A |
| File opened for reading | /proc/16/cmdline | N/A | N/A |
| File opened for reading | /proc/1069/cmdline | N/A | N/A |
| File opened for reading | /proc/85/cmdline | N/A | N/A |
| File opened for reading | /proc/162/cmdline | N/A | N/A |
| File opened for reading | /proc/206/cmdline | N/A | N/A |
| File opened for reading | /proc/242/cmdline | N/A | N/A |
| File opened for reading | /proc/425/cmdline | N/A | N/A |
| File opened for reading | /proc/672/cmdline | N/A | N/A |
| File opened for reading | /proc/1128/cmdline | N/A | N/A |
| File opened for reading | /proc/2/cmdline | N/A | N/A |
| File opened for reading | /proc/526/cmdline | N/A | N/A |
| File opened for reading | /proc/662/cmdline | N/A | N/A |
| File opened for reading | /proc/8/cmdline | N/A | N/A |
| File opened for reading | /proc/1083/cmdline | N/A | N/A |
| File opened for reading | /proc/22/cmdline | N/A | N/A |
| File opened for reading | /proc/84/cmdline | N/A | N/A |
| File opened for reading | /proc/173/cmdline | N/A | N/A |
| File opened for reading | /proc/446/cmdline | N/A | N/A |
| File opened for reading | /proc/1035/cmdline | N/A | N/A |
| File opened for reading | /proc/21/cmdline | N/A | N/A |
| File opened for reading | /proc/657/cmdline | N/A | N/A |
| File opened for reading | /proc/1029/cmdline | N/A | N/A |
| File opened for reading | /proc/1063/cmdline | N/A | N/A |
| File opened for reading | /proc/13/cmdline | N/A | N/A |
| File opened for reading | /proc/15/cmdline | N/A | N/A |
| File opened for reading | /proc/29/cmdline | N/A | N/A |
| File opened for reading | /proc/36/cmdline | N/A | N/A |
| File opened for reading | /proc/168/cmdline | N/A | N/A |
Processes
/tmp/05f3c0e2c731be80a68df7e87856050a.elf
[/tmp/05f3c0e2c731be80a68df7e87856050a.elf]
Network
| Country | Destination | Domain | Proto |
| GB | 185.125.188.62:443 | tcp | |
| GB | 185.125.188.62:443 | tcp | |
| US | 151.101.129.91:443 | tcp | |
| US | 151.101.194.49:443 | tcp | |
| US | 151.101.129.91:443 | tcp | |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| NL | 89.190.156.145:7733 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| GB | 195.181.164.14:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
Files
N/A