Analysis Overview
SHA256
d1bef23d3ac3f09d9a72f65b3cba4fe60a0c75ea3b2fafd577a7e4e5531c8c09
Threat Level: Known bad
The file d1bef23d3ac3f09d9a72f65b3cba4fe60a0c75ea3b2fafd577a7e4e5531c8c09.elf was found to be: Known bad.
Malicious Activity Summary
Mirai family
Changes its process name
Deletes itself
Enumerates running processes
Reads runtime system information
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-04-18 02:00
Signatures
Mirai family
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-18 02:00
Reported
2024-04-18 02:02
Platform
ubuntu2004-amd64-20240221-en
Max time kernel
131s
Max time network
142s
Command Line
Signatures
Changes its process name
| Description | Indicator | Process | Target |
| Changes the process name, possibly in an attempt to hide itself | httpd | /tmp/d1bef23d3ac3f09d9a72f65b3cba4fe60a0c75ea3b2fafd577a7e4e5531c8c09.elf | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | /tmp/d1bef23d3ac3f09d9a72f65b3cba4fe60a0c75ea3b2fafd577a7e4e5531c8c09.elf | N/A |
Enumerates running processes
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/20/cmdline | N/A | N/A |
| File opened for reading | /proc/23/cmdline | N/A | N/A |
| File opened for reading | /proc/169/cmdline | N/A | N/A |
| File opened for reading | /proc/201/cmdline | N/A | N/A |
| File opened for reading | /proc/492/cmdline | N/A | N/A |
| File opened for reading | /proc/809/cmdline | N/A | N/A |
| File opened for reading | /proc/171/cmdline | N/A | N/A |
| File opened for reading | /proc/175/cmdline | N/A | N/A |
| File opened for reading | /proc/579/cmdline | N/A | N/A |
| File opened for reading | /proc/15/cmdline | N/A | N/A |
| File opened for reading | /proc/18/cmdline | N/A | N/A |
| File opened for reading | /proc/118/cmdline | N/A | N/A |
| File opened for reading | /proc/160/cmdline | N/A | N/A |
| File opened for reading | /proc/534/cmdline | N/A | N/A |
| File opened for reading | /proc/616/cmdline | N/A | N/A |
| File opened for reading | /proc/966/cmdline | N/A | N/A |
| File opened for reading | /proc/1031/cmdline | N/A | N/A |
| File opened for reading | /proc/1095/cmdline | N/A | N/A |
| File opened for reading | /proc/21/cmdline | N/A | N/A |
| File opened for reading | /proc/440/cmdline | N/A | N/A |
| File opened for reading | /proc/511/cmdline | N/A | N/A |
| File opened for reading | /proc/9/cmdline | N/A | N/A |
| File opened for reading | /proc/269/cmdline | N/A | N/A |
| File opened for reading | /proc/451/cmdline | N/A | N/A |
| File opened for reading | /proc/561/cmdline | N/A | N/A |
| File opened for reading | /proc/1040/cmdline | N/A | N/A |
| File opened for reading | /proc/10/cmdline | N/A | N/A |
| File opened for reading | /proc/22/cmdline | N/A | N/A |
| File opened for reading | /proc/92/cmdline | N/A | N/A |
| File opened for reading | /proc/163/cmdline | N/A | N/A |
| File opened for reading | /proc/167/cmdline | N/A | N/A |
| File opened for reading | /proc/177/cmdline | N/A | N/A |
| File opened for reading | /proc/1044/cmdline | N/A | N/A |
| File opened for reading | /proc/70/cmdline | N/A | N/A |
| File opened for reading | /proc/79/cmdline | N/A | N/A |
| File opened for reading | /proc/131/cmdline | N/A | N/A |
| File opened for reading | /proc/200/cmdline | N/A | N/A |
| File opened for reading | /proc/242/cmdline | N/A | N/A |
| File opened for reading | /proc/498/cmdline | N/A | N/A |
| File opened for reading | /proc/547/cmdline | N/A | N/A |
| File opened for reading | /proc/621/cmdline | N/A | N/A |
| File opened for reading | /proc/438/cmdline | N/A | N/A |
| File opened for reading | /proc/476/cmdline | N/A | N/A |
| File opened for reading | /proc/497/cmdline | N/A | N/A |
| File opened for reading | /proc/835/cmdline | N/A | N/A |
| File opened for reading | /proc/88/cmdline | N/A | N/A |
| File opened for reading | /proc/166/cmdline | N/A | N/A |
| File opened for reading | /proc/174/cmdline | N/A | N/A |
| File opened for reading | /proc/910/cmdline | N/A | N/A |
| File opened for reading | /proc/1087/cmdline | N/A | N/A |
| File opened for reading | /proc/76/cmdline | N/A | N/A |
| File opened for reading | /proc/310/cmdline | N/A | N/A |
| File opened for reading | /proc/450/cmdline | N/A | N/A |
| File opened for reading | /proc/570/cmdline | N/A | N/A |
| File opened for reading | /proc/670/cmdline | N/A | N/A |
| File opened for reading | /proc/75/cmdline | N/A | N/A |
| File opened for reading | /proc/91/cmdline | N/A | N/A |
| File opened for reading | /proc/471/cmdline | N/A | N/A |
| File opened for reading | /proc/6/cmdline | N/A | N/A |
| File opened for reading | /proc/8/cmdline | N/A | N/A |
| File opened for reading | /proc/516/cmdline | N/A | N/A |
| File opened for reading | /proc/1078/cmdline | N/A | N/A |
| File opened for reading | /proc/1088/cmdline | N/A | N/A |
| File opened for reading | /proc/19/cmdline | N/A | N/A |
Processes
/tmp/d1bef23d3ac3f09d9a72f65b3cba4fe60a0c75ea3b2fafd577a7e4e5531c8c09.elf
[/tmp/d1bef23d3ac3f09d9a72f65b3cba4fe60a0c75ea3b2fafd577a7e4e5531c8c09.elf]
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| DE | 45.131.111.219:33966 | kovey.mezo-api.xyz | tcp |
| NL | 89.190.156.145:7733 | tcp | |
| US | 1.1.1.1:53 | connectivity-check.ubuntu.com | udp |
| US | 1.1.1.1:53 | cdn.fwupd.org | udp |
| US | 1.1.1.1:53 | cdn.fwupd.org | udp |
| US | 151.101.2.49:443 | cdn.fwupd.org | tcp |
| US | 151.101.2.49:443 | cdn.fwupd.org | tcp |
| US | 1.1.1.1:53 | _https._tcp.deb.nodesource.com | udp |
| US | 1.1.1.1:53 | _http._tcp.security.ubuntu.com | udp |
| US | 1.1.1.1:53 | _http._tcp.nl.archive.ubuntu.com | udp |
| US | 1.1.1.1:53 | deb.nodesource.com | udp |
| US | 1.1.1.1:53 | deb.nodesource.com | udp |
| US | 1.1.1.1:53 | security.ubuntu.com | udp |
| US | 1.1.1.1:53 | security.ubuntu.com | udp |
| US | 1.1.1.1:53 | nl.archive.ubuntu.com | udp |
| US | 1.1.1.1:53 | nl.archive.ubuntu.com | udp |
| US | 91.189.91.81:80 | security.ubuntu.com | tcp |
| US | 104.22.4.26:443 | deb.nodesource.com | tcp |
| NL | 213.136.12.213:80 | nl.archive.ubuntu.com | tcp |
| NL | 213.136.12.213:80 | nl.archive.ubuntu.com | tcp |
| NL | 213.136.12.213:80 | nl.archive.ubuntu.com | tcp |
| US | 1.1.1.1:53 | _https._tcp.motd.ubuntu.com | udp |
| US | 1.1.1.1:53 | motd.ubuntu.com | udp |
| US | 1.1.1.1:53 | motd.ubuntu.com | udp |
| IE | 54.247.62.1:443 | motd.ubuntu.com | tcp |
| US | 1.1.1.1:53 | _https._tcp.esm.ubuntu.com | udp |
| US | 1.1.1.1:53 | esm.ubuntu.com | udp |
| US | 1.1.1.1:53 | esm.ubuntu.com | udp |
| GB | 185.125.190.24:443 | esm.ubuntu.com | tcp |
| NL | 213.136.12.213:80 | nl.archive.ubuntu.com | tcp |
| NL | 213.136.12.213:80 | nl.archive.ubuntu.com | tcp |
| NL | 213.136.12.213:80 | nl.archive.ubuntu.com | tcp |
| NL | 213.136.12.213:80 | nl.archive.ubuntu.com | tcp |
| NL | 213.136.12.213:80 | nl.archive.ubuntu.com | tcp |
| NL | 213.136.12.213:80 | nl.archive.ubuntu.com | tcp |
| NL | 213.136.12.213:80 | nl.archive.ubuntu.com | tcp |
| NL | 213.136.12.213:80 | nl.archive.ubuntu.com | tcp |
| NL | 213.136.12.213:80 | nl.archive.ubuntu.com | tcp |
| NL | 213.136.12.213:80 | nl.archive.ubuntu.com | tcp |
| NL | 213.136.12.213:80 | nl.archive.ubuntu.com | tcp |
| NL | 213.136.12.213:80 | nl.archive.ubuntu.com | tcp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| US | 8.8.8.8:53 | kovey.mezo-api.xyz | udp |
| DE | 45.131.111.219:33966 | kovey.mezo-api.xyz | tcp |
| US | 1.1.1.1:53 | connectivity-check.ubuntu.com | udp |