Analysis Overview
SHA256
fbde07f0582c954a0300e48cf4e70b54c155b05bc8780c04a34ad80c3e738ef8
Threat Level: Known bad
The file fbde07f0582c954a0300e48cf4e70b54c155b05bc8780c04a34ad80c3e738ef8.elf was found to be: Known bad.
Malicious Activity Summary
Mirai family
Deletes itself
Changes its process name
Enumerates running processes
Reads runtime system information
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-04-15 01:27
Signatures
Mirai family
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-15 01:27
Reported
2024-04-15 01:30
Platform
ubuntu1804-amd64-20240226-en
Max time kernel
142s
Max time network
145s
Command Line
Signatures
Changes its process name
| Description | Indicator | Process | Target |
| Changes the process name, possibly in an attempt to hide itself | httpd | /tmp/fbde07f0582c954a0300e48cf4e70b54c155b05bc8780c04a34ad80c3e738ef8.elf | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Enumerates running processes
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/168/cmdline | N/A | N/A |
| File opened for reading | /proc/424/cmdline | N/A | N/A |
| File opened for reading | /proc/519/cmdline | N/A | N/A |
| File opened for reading | /proc/1028/cmdline | N/A | N/A |
| File opened for reading | /proc/13/cmdline | N/A | N/A |
| File opened for reading | /proc/22/cmdline | N/A | N/A |
| File opened for reading | /proc/35/cmdline | N/A | N/A |
| File opened for reading | /proc/466/cmdline | N/A | N/A |
| File opened for reading | /proc/939/cmdline | N/A | N/A |
| File opened for reading | /proc/965/cmdline | N/A | N/A |
| File opened for reading | /proc/7/cmdline | N/A | N/A |
| File opened for reading | /proc/25/cmdline | N/A | N/A |
| File opened for reading | /proc/179/cmdline | N/A | N/A |
| File opened for reading | /proc/182/cmdline | N/A | N/A |
| File opened for reading | /proc/311/cmdline | N/A | N/A |
| File opened for reading | /proc/417/cmdline | N/A | N/A |
| File opened for reading | /proc/1048/cmdline | N/A | N/A |
| File opened for reading | /proc/180/cmdline | N/A | N/A |
| File opened for reading | /proc/208/cmdline | N/A | N/A |
| File opened for reading | /proc/32/cmdline | N/A | N/A |
| File opened for reading | /proc/81/cmdline | N/A | N/A |
| File opened for reading | /proc/274/cmdline | N/A | N/A |
| File opened for reading | /proc/649/cmdline | N/A | N/A |
| File opened for reading | /proc/1074/cmdline | N/A | N/A |
| File opened for reading | /proc/28/cmdline | N/A | N/A |
| File opened for reading | /proc/1120/cmdline | N/A | N/A |
| File opened for reading | /proc/1150/cmdline | N/A | N/A |
| File opened for reading | /proc/27/cmdline | N/A | N/A |
| File opened for reading | /proc/84/cmdline | N/A | N/A |
| File opened for reading | /proc/175/cmdline | N/A | N/A |
| File opened for reading | /proc/699/cmdline | N/A | N/A |
| File opened for reading | /proc/968/cmdline | N/A | N/A |
| File opened for reading | /proc/20/cmdline | N/A | N/A |
| File opened for reading | /proc/521/cmdline | N/A | N/A |
| File opened for reading | /proc/547/cmdline | N/A | N/A |
| File opened for reading | /proc/1087/cmdline | N/A | N/A |
| File opened for reading | /proc/1119/cmdline | N/A | N/A |
| File opened for reading | /proc/1155/cmdline | N/A | N/A |
| File opened for reading | /proc/163/cmdline | N/A | N/A |
| File opened for reading | /proc/164/cmdline | N/A | N/A |
| File opened for reading | /proc/178/cmdline | N/A | N/A |
| File opened for reading | /proc/553/cmdline | N/A | N/A |
| File opened for reading | /proc/19/cmdline | N/A | N/A |
| File opened for reading | /proc/82/cmdline | N/A | N/A |
| File opened for reading | /proc/85/cmdline | N/A | N/A |
| File opened for reading | /proc/166/cmdline | N/A | N/A |
| File opened for reading | /proc/31/cmdline | N/A | N/A |
| File opened for reading | /proc/98/cmdline | N/A | N/A |
| File opened for reading | /proc/455/cmdline | N/A | N/A |
| File opened for reading | /proc/730/cmdline | N/A | N/A |
| File opened for reading | /proc/1061/cmdline | N/A | N/A |
| File opened for reading | /proc/29/cmdline | N/A | N/A |
| File opened for reading | /proc/115/cmdline | N/A | N/A |
| File opened for reading | /proc/177/cmdline | N/A | N/A |
| File opened for reading | /proc/442/cmdline | N/A | N/A |
| File opened for reading | /proc/1064/cmdline | N/A | N/A |
| File opened for reading | /proc/1153/cmdline | N/A | N/A |
| File opened for reading | /proc/170/cmdline | N/A | N/A |
| File opened for reading | /proc/441/cmdline | N/A | N/A |
| File opened for reading | /proc/483/cmdline | N/A | N/A |
| File opened for reading | /proc/612/cmdline | N/A | N/A |
| File opened for reading | /proc/1104/cmdline | N/A | N/A |
| File opened for reading | /proc/1132/cmdline | N/A | N/A |
| File opened for reading | /proc/956/cmdline | N/A | N/A |
Processes
/tmp/fbde07f0582c954a0300e48cf4e70b54c155b05bc8780c04a34ad80c3e738ef8.elf
[/tmp/fbde07f0582c954a0300e48cf4e70b54c155b05bc8780c04a34ad80c3e738ef8.elf]
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| NL | 89.190.156.145:7733 | tcp | |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 151.101.130.49:443 | tcp | |
| US | 151.101.65.91:443 | tcp | |
| GB | 195.181.164.14:443 | tcp | |
| GB | 185.125.188.62:443 | tcp | |
| GB | 185.125.188.61:443 | tcp | |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | raw.mezo-api.xyz | udp |
| DE | 35.198.149.52:33966 | raw.mezo-api.xyz | tcp |