Analysis Overview
score
10/10
SHA256
7f3e57bdde7a07c2adc37982642f42c1fe23be702b2d018bcdf41c97c0ac5060
Threat Level: Known bad
The file 8ea122771d5c6a928d94793db9434d6c.elf was found to be: Known bad.
Malicious Activity Summary
Mirai family
Changes its process name
Deletes itself
Enumerates running processes
Reads runtime system information
MITRE ATT&CK
N/A
Analysis: static1
Detonation Overview
Reported
2024-04-17 21:11
Signatures
Mirai family
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-17 21:11
Reported
2024-04-17 21:13
Platform
ubuntu1804-amd64-20240226-en
Max time kernel
139s
Max time network
143s
Command Line
[/tmp/8ea122771d5c6a928d94793db9434d6c.elf]
Signatures
Changes its process name
| Description | Indicator | Process | Target |
| Changes the process name, possibly in an attempt to hide itself | httpd | /tmp/8ea122771d5c6a928d94793db9434d6c.elf | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Enumerates running processes
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/17/cmdline | N/A | N/A |
| File opened for reading | /proc/163/cmdline | N/A | N/A |
| File opened for reading | /proc/197/cmdline | N/A | N/A |
| File opened for reading | /proc/932/cmdline | N/A | N/A |
| File opened for reading | /proc/1153/cmdline | N/A | N/A |
| File opened for reading | /proc/6/cmdline | N/A | N/A |
| File opened for reading | /proc/155/cmdline | N/A | N/A |
| File opened for reading | /proc/1056/cmdline | N/A | N/A |
| File opened for reading | /proc/1086/cmdline | N/A | N/A |
| File opened for reading | /proc/32/cmdline | N/A | N/A |
| File opened for reading | /proc/80/cmdline | N/A | N/A |
| File opened for reading | /proc/641/cmdline | N/A | N/A |
| File opened for reading | /proc/647/cmdline | N/A | N/A |
| File opened for reading | /proc/1023/cmdline | N/A | N/A |
| File opened for reading | /proc/9/cmdline | N/A | N/A |
| File opened for reading | /proc/11/cmdline | N/A | N/A |
| File opened for reading | /proc/98/cmdline | N/A | N/A |
| File opened for reading | /proc/441/cmdline | N/A | N/A |
| File opened for reading | /proc/21/cmdline | N/A | N/A |
| File opened for reading | /proc/31/cmdline | N/A | N/A |
| File opened for reading | /proc/170/cmdline | N/A | N/A |
| File opened for reading | /proc/712/cmdline | N/A | N/A |
| File opened for reading | /proc/1115/cmdline | N/A | N/A |
| File opened for reading | /proc/1123/cmdline | N/A | N/A |
| File opened for reading | /proc/5/cmdline | N/A | N/A |
| File opened for reading | /proc/18/cmdline | N/A | N/A |
| File opened for reading | /proc/444/cmdline | N/A | N/A |
| File opened for reading | /proc/642/cmdline | N/A | N/A |
| File opened for reading | /proc/947/cmdline | N/A | N/A |
| File opened for reading | /proc/248/cmdline | N/A | N/A |
| File opened for reading | /proc/15/cmdline | N/A | N/A |
| File opened for reading | /proc/85/cmdline | N/A | N/A |
| File opened for reading | /proc/157/cmdline | N/A | N/A |
| File opened for reading | /proc/166/cmdline | N/A | N/A |
| File opened for reading | /proc/957/cmdline | N/A | N/A |
| File opened for reading | /proc/1150/cmdline | N/A | N/A |
| File opened for reading | /proc/83/cmdline | N/A | N/A |
| File opened for reading | /proc/154/cmdline | N/A | N/A |
| File opened for reading | /proc/156/cmdline | N/A | N/A |
| File opened for reading | /proc/165/cmdline | N/A | N/A |
| File opened for reading | /proc/1127/cmdline | N/A | N/A |
| File opened for reading | /proc/1131/cmdline | N/A | N/A |
| File opened for reading | /proc/4/cmdline | N/A | N/A |
| File opened for reading | /proc/81/cmdline | N/A | N/A |
| File opened for reading | /proc/436/cmdline | N/A | N/A |
| File opened for reading | /proc/1069/cmdline | N/A | N/A |
| File opened for reading | /proc/1099/cmdline | N/A | N/A |
| File opened for reading | /proc/79/cmdline | N/A | N/A |
| File opened for reading | /proc/164/cmdline | N/A | N/A |
| File opened for reading | /proc/1058/cmdline | N/A | N/A |
| File opened for reading | /proc/1139/cmdline | N/A | N/A |
| File opened for reading | /proc/509/cmdline | N/A | N/A |
| File opened for reading | /proc/566/cmdline | N/A | N/A |
| File opened for reading | /proc/722/cmdline | N/A | N/A |
| File opened for reading | /proc/2/cmdline | N/A | N/A |
| File opened for reading | /proc/12/cmdline | N/A | N/A |
| File opened for reading | /proc/13/cmdline | N/A | N/A |
| File opened for reading | /proc/169/cmdline | N/A | N/A |
| File opened for reading | /proc/472/cmdline | N/A | N/A |
| File opened for reading | /proc/460/cmdline | N/A | N/A |
| File opened for reading | /proc/1018/cmdline | N/A | N/A |
| File opened for reading | /proc/167/cmdline | N/A | N/A |
| File opened for reading | /proc/168/cmdline | N/A | N/A |
| File opened for reading | /proc/592/cmdline | N/A | N/A |
Processes
/tmp/8ea122771d5c6a928d94793db9434d6c.elf
[/tmp/8ea122771d5c6a928d94793db9434d6c.elf]
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| NL | 89.190.156.145:7733 | tcp | |
| US | 151.101.130.49:443 | tcp | |
| US | 1.1.1.1:53 | cdn.fwupd.org | udp |
| US | 1.1.1.1:53 | cdn.fwupd.org | udp |
| US | 151.101.194.49:443 | cdn.fwupd.org | tcp |
| US | 151.101.1.91:443 | tcp | |
| GB | 89.187.167.3:443 | tcp | |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| DE | 45.131.111.219:33966 | kovey.mezo-api.xyz | tcp |
| GB | 185.125.188.61:443 | tcp | |
| GB | 185.125.188.62:443 | tcp | |
| US | 151.101.1.91:443 | tcp | |
| US | 1.1.1.1:53 | 1527653184.rsc.cdn77.org | udp |
| US | 1.1.1.1:53 | 1527653184.rsc.cdn77.org | udp |
| GB | 195.181.164.21:443 | 1527653184.rsc.cdn77.org | tcp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| DE | 45.131.111.219:33966 | kovey.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| DE | 45.131.111.219:33966 | kovey.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| DE | 45.131.111.219:33966 | kovey.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| DE | 45.131.111.219:33966 | kovey.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| DE | 45.131.111.219:33966 | kovey.mezo-api.xyz | tcp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| DE | 45.131.111.219:33966 | kovey.mezo-api.xyz | tcp |
Files
N/A