Analysis Overview
score
10/10
SHA256
d1bef23d3ac3f09d9a72f65b3cba4fe60a0c75ea3b2fafd577a7e4e5531c8c09
Threat Level: Known bad
The file c65bae60afbc66685e7794992337cb65.elf was found to be: Known bad.
Malicious Activity Summary
Mirai family
Changes its process name
Deletes itself
Enumerates running processes
Reads runtime system information
MITRE ATT&CK
N/A
Analysis: static1
Detonation Overview
Reported
2024-04-17 21:05
Signatures
Mirai family
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-17 21:05
Reported
2024-04-17 21:07
Platform
ubuntu1804-amd64-20240226-en
Max time kernel
135s
Max time network
131s
Command Line
[/tmp/c65bae60afbc66685e7794992337cb65.elf]
Signatures
Changes its process name
| Description | Indicator | Process | Target |
| Changes the process name, possibly in an attempt to hide itself | httpd | /tmp/c65bae60afbc66685e7794992337cb65.elf | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | /tmp/c65bae60afbc66685e7794992337cb65.elf | N/A |
Enumerates running processes
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/586/cmdline | N/A | N/A |
| File opened for reading | /proc/98/cmdline | N/A | N/A |
| File opened for reading | /proc/172/cmdline | N/A | N/A |
| File opened for reading | /proc/163/cmdline | N/A | N/A |
| File opened for reading | /proc/424/cmdline | N/A | N/A |
| File opened for reading | /proc/724/cmdline | N/A | N/A |
| File opened for reading | /proc/15/cmdline | N/A | N/A |
| File opened for reading | /proc/82/cmdline | N/A | N/A |
| File opened for reading | /proc/442/cmdline | N/A | N/A |
| File opened for reading | /proc/1136/cmdline | N/A | N/A |
| File opened for reading | /proc/166/cmdline | N/A | N/A |
| File opened for reading | /proc/176/cmdline | N/A | N/A |
| File opened for reading | /proc/83/cmdline | N/A | N/A |
| File opened for reading | /proc/242/cmdline | N/A | N/A |
| File opened for reading | /proc/1048/cmdline | N/A | N/A |
| File opened for reading | /proc/16/cmdline | N/A | N/A |
| File opened for reading | /proc/81/cmdline | N/A | N/A |
| File opened for reading | /proc/1023/cmdline | N/A | N/A |
| File opened for reading | /proc/208/cmdline | N/A | N/A |
| File opened for reading | /proc/519/cmdline | N/A | N/A |
| File opened for reading | /proc/1074/cmdline | N/A | N/A |
| File opened for reading | /proc/1077/cmdline | N/A | N/A |
| File opened for reading | /proc/23/cmdline | N/A | N/A |
| File opened for reading | /proc/24/cmdline | N/A | N/A |
| File opened for reading | /proc/29/cmdline | N/A | N/A |
| File opened for reading | /proc/89/cmdline | N/A | N/A |
| File opened for reading | /proc/179/cmdline | N/A | N/A |
| File opened for reading | /proc/643/cmdline | N/A | N/A |
| File opened for reading | /proc/699/cmdline | N/A | N/A |
| File opened for reading | /proc/1072/cmdline | N/A | N/A |
| File opened for reading | /proc/12/cmdline | N/A | N/A |
| File opened for reading | /proc/14/cmdline | N/A | N/A |
| File opened for reading | /proc/1104/cmdline | N/A | N/A |
| File opened for reading | /proc/311/cmdline | N/A | N/A |
| File opened for reading | /proc/461/cmdline | N/A | N/A |
| File opened for reading | /proc/1128/cmdline | N/A | N/A |
| File opened for reading | /proc/1132/cmdline | N/A | N/A |
| File opened for reading | /proc/4/cmdline | N/A | N/A |
| File opened for reading | /proc/80/cmdline | N/A | N/A |
| File opened for reading | /proc/129/cmdline | N/A | N/A |
| File opened for reading | /proc/472/cmdline | N/A | N/A |
| File opened for reading | /proc/3/cmdline | N/A | N/A |
| File opened for reading | /proc/10/cmdline | N/A | N/A |
| File opened for reading | /proc/31/cmdline | N/A | N/A |
| File opened for reading | /proc/165/cmdline | N/A | N/A |
| File opened for reading | /proc/274/cmdline | N/A | N/A |
| File opened for reading | /proc/1091/cmdline | N/A | N/A |
| File opened for reading | /proc/1155/cmdline | N/A | N/A |
| File opened for reading | /proc/13/cmdline | N/A | N/A |
| File opened for reading | /proc/26/cmdline | N/A | N/A |
| File opened for reading | /proc/417/cmdline | N/A | N/A |
| File opened for reading | /proc/483/cmdline | N/A | N/A |
| File opened for reading | /proc/968/cmdline | N/A | N/A |
| File opened for reading | /proc/115/cmdline | N/A | N/A |
| File opened for reading | /proc/164/cmdline | N/A | N/A |
| File opened for reading | /proc/563/cmdline | N/A | N/A |
| File opened for reading | /proc/25/cmdline | N/A | N/A |
| File opened for reading | /proc/455/cmdline | N/A | N/A |
| File opened for reading | /proc/547/cmdline | N/A | N/A |
| File opened for reading | /proc/1087/cmdline | N/A | N/A |
| File opened for reading | /proc/35/cmdline | N/A | N/A |
| File opened for reading | /proc/79/cmdline | N/A | N/A |
| File opened for reading | /proc/961/cmdline | N/A | N/A |
| File opened for reading | /proc/85/cmdline | N/A | N/A |
Processes
/tmp/c65bae60afbc66685e7794992337cb65.elf
[/tmp/c65bae60afbc66685e7794992337cb65.elf]
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| NL | 89.190.156.145:7733 | tcp | |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| DE | 45.131.111.219:33966 | kovey.mezo-api.xyz | tcp |
| US | 151.101.130.49:443 | tcp | |
| US | 1.1.1.1:53 | cdn.fwupd.org | udp |
| US | 1.1.1.1:53 | cdn.fwupd.org | udp |
| US | 151.101.194.49:443 | cdn.fwupd.org | tcp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| DE | 45.131.111.219:33966 | kovey.mezo-api.xyz | tcp |
| GB | 185.125.188.62:443 | tcp | |
| GB | 185.125.188.61:443 | tcp | |
| US | 151.101.65.91:443 | tcp | |
| US | 151.101.65.91:443 | tcp | |
| GB | 195.181.164.14:443 | tcp |
Files
N/A