Malware Analysis Report

2025-03-15 03:10

Sample ID 240414-ssftwscd9s
Target 05f3c0e2c731be80a68df7e87856050a.elf
SHA256 b25fd94d5941b7737bf859904e05087be415c128e3148fc6c8a82cbc0184ded4
Tags
botnet mirai
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b25fd94d5941b7737bf859904e05087be415c128e3148fc6c8a82cbc0184ded4

Threat Level: Known bad

The file 05f3c0e2c731be80a68df7e87856050a.elf was found to be: Known bad.

Malicious Activity Summary

botnet mirai

Mirai family

Changes its process name

Deletes itself

Enumerates running processes

Reads runtime system information

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-04-14 15:23

Signatures

Mirai family

mirai

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-14 15:23

Reported

2024-04-14 15:25

Platform

ubuntu1804-amd64-20240226-en

Max time kernel

134s

Max time network

140s

Command Line

[/tmp/05f3c0e2c731be80a68df7e87856050a.elf]

Signatures

Changes its process name

Description Indicator Process Target
Changes the process name, possibly in an attempt to hide itself httpd /tmp/05f3c0e2c731be80a68df7e87856050a.elf N/A

Deletes itself

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates running processes

Reads runtime system information

Description Indicator Process Target
File opened for reading /proc/10/cmdline N/A N/A
File opened for reading /proc/1136/cmdline N/A N/A
File opened for reading /proc/14/cmdline N/A N/A
File opened for reading /proc/24/cmdline N/A N/A
File opened for reading /proc/546/cmdline N/A N/A
File opened for reading /proc/950/cmdline N/A N/A
File opened for reading /proc/1132/cmdline N/A N/A
File opened for reading /proc/163/cmdline N/A N/A
File opened for reading /proc/178/cmdline N/A N/A
File opened for reading /proc/207/cmdline N/A N/A
File opened for reading /proc/35/cmdline N/A N/A
File opened for reading /proc/170/cmdline N/A N/A
File opened for reading /proc/174/cmdline N/A N/A
File opened for reading /proc/176/cmdline N/A N/A
File opened for reading /proc/323/cmdline N/A N/A
File opened for reading /proc/696/cmdline N/A N/A
File opened for reading /proc/164/cmdline N/A N/A
File opened for reading /proc/89/cmdline N/A N/A
File opened for reading /proc/956/cmdline N/A N/A
File opened for reading /proc/1106/cmdline N/A N/A
File opened for reading /proc/1141/cmdline N/A N/A
File opened for reading /proc/5/cmdline N/A N/A
File opened for reading /proc/32/cmdline N/A N/A
File opened for reading /proc/169/cmdline N/A N/A
File opened for reading /proc/494/cmdline N/A N/A
File opened for reading /proc/517/cmdline N/A N/A
File opened for reading /proc/569/cmdline N/A N/A
File opened for reading /proc/965/cmdline N/A N/A
File opened for reading /proc/1065/cmdline N/A N/A
File opened for reading /proc/1120/cmdline N/A N/A
File opened for reading /proc/11/cmdline N/A N/A
File opened for reading /proc/31/cmdline N/A N/A
File opened for reading /proc/489/cmdline N/A N/A
File opened for reading /proc/888/cmdline N/A N/A
File opened for reading /proc/1087/cmdline N/A N/A
File opened for reading /proc/1116/cmdline N/A N/A
File opened for reading /proc/16/cmdline N/A N/A
File opened for reading /proc/1069/cmdline N/A N/A
File opened for reading /proc/85/cmdline N/A N/A
File opened for reading /proc/162/cmdline N/A N/A
File opened for reading /proc/206/cmdline N/A N/A
File opened for reading /proc/242/cmdline N/A N/A
File opened for reading /proc/425/cmdline N/A N/A
File opened for reading /proc/672/cmdline N/A N/A
File opened for reading /proc/1128/cmdline N/A N/A
File opened for reading /proc/2/cmdline N/A N/A
File opened for reading /proc/526/cmdline N/A N/A
File opened for reading /proc/662/cmdline N/A N/A
File opened for reading /proc/8/cmdline N/A N/A
File opened for reading /proc/1083/cmdline N/A N/A
File opened for reading /proc/22/cmdline N/A N/A
File opened for reading /proc/84/cmdline N/A N/A
File opened for reading /proc/173/cmdline N/A N/A
File opened for reading /proc/446/cmdline N/A N/A
File opened for reading /proc/1035/cmdline N/A N/A
File opened for reading /proc/21/cmdline N/A N/A
File opened for reading /proc/657/cmdline N/A N/A
File opened for reading /proc/1029/cmdline N/A N/A
File opened for reading /proc/1063/cmdline N/A N/A
File opened for reading /proc/13/cmdline N/A N/A
File opened for reading /proc/15/cmdline N/A N/A
File opened for reading /proc/29/cmdline N/A N/A
File opened for reading /proc/36/cmdline N/A N/A
File opened for reading /proc/168/cmdline N/A N/A

Processes

/tmp/05f3c0e2c731be80a68df7e87856050a.elf

[/tmp/05f3c0e2c731be80a68df7e87856050a.elf]

Network

Country Destination Domain Proto
GB 185.125.188.62:443 tcp
GB 185.125.188.62:443 tcp
US 151.101.129.91:443 tcp
US 151.101.194.49:443 tcp
US 151.101.129.91:443 tcp
US 8.8.8.8:53 raw.mezo-api.xyz udp
NL 89.190.156.145:7733 tcp
US 8.8.8.8:53 udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
DE 35.198.149.52:33966 raw.mezo-api.xyz tcp
GB 195.181.164.14:443 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
DE 35.198.149.52:33966 raw.mezo-api.xyz tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
DE 35.198.149.52:33966 raw.mezo-api.xyz tcp

Files

N/A