Malware Analysis Report

2024-11-15 05:12

Sample ID 240418-yxn9qaeh3v
Target 7ea93bc649d53c24353af71f91554b72.elf
SHA256 d61212c6fdd6ca3b1089639dee5089d0324195b595fb1e0b653a6f5ba9953871
Tags
mirai mirai
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d61212c6fdd6ca3b1089639dee5089d0324195b595fb1e0b653a6f5ba9953871

Threat Level: Known bad

The file 7ea93bc649d53c24353af71f91554b72.elf was found to be: Known bad.

Malicious Activity Summary

mirai mirai

Mirai family

Changes its process name

Reads runtime system information

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-04-18 20:10

Signatures

Mirai family

mirai

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-18 20:10

Reported

2024-04-18 20:12

Platform

debian9-armhf-20240226-en

Max time kernel

149s

Max time network

144s

Command Line

[/tmp/7ea93bc649d53c24353af71f91554b72.elf]

Signatures

Changes its process name

Description Indicator Process Target
Changes the process name, possibly in an attempt to hide itself a /tmp/7ea93bc649d53c24353af71f91554b72.elf N/A

Reads runtime system information

Description Indicator Process Target
File opened for reading /proc/1/maps N/A N/A

Processes

/tmp/7ea93bc649d53c24353af71f91554b72.elf

[/tmp/7ea93bc649d53c24353af71f91554b72.elf]

Network

Country Destination Domain Proto
DE 185.117.3.184:3589 tcp
DE 185.117.3.184:3589 tcp
DE 185.117.3.184:3589 tcp

Files

N/A