Analysis Overview
score
10/10
SHA256
f7f1973f6160bb4251ea95ebd1c3a5e6ef39c28a1a98e40aef7542b4daeb80a0
Threat Level: Known bad
The file f7f1973f6160bb4251ea95ebd1c3a5e6ef39c28a1a98e40aef7542b4daeb80a0.elf was found to be: Known bad.
Malicious Activity Summary
Mirai family
Changes its process name
Enumerates running processes
Reads runtime system information
MITRE ATT&CK
N/A
Analysis: static1
Detonation Overview
Reported
2024-04-19 02:13
Signatures
Mirai family
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-19 02:13
Reported
2024-04-19 02:16
Platform
debian9-armhf-20240226-en
Max time kernel
149s
Max time network
153s
Command Line
[/tmp/f7f1973f6160bb4251ea95ebd1c3a5e6ef39c28a1a98e40aef7542b4daeb80a0.elf]
Signatures
Changes its process name
| Description | Indicator | Process | Target |
| Changes the process name, possibly in an attempt to hide itself | -"6 | /tmp/f7f1973f6160bb4251ea95ebd1c3a5e6ef39c28a1a98e40aef7542b4daeb80a0.elf | N/A |
Enumerates running processes
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/13/cmdline | N/A | N/A |
| File opened for reading | /proc/279/cmdline | N/A | N/A |
| File opened for reading | /proc/660/cmdline | N/A | N/A |
| File opened for reading | /proc/692/cmdline | N/A | N/A |
| File opened for reading | /proc/730/cmdline | N/A | N/A |
| File opened for reading | /proc/766/cmdline | N/A | N/A |
| File opened for reading | /proc/773/cmdline | N/A | N/A |
| File opened for reading | /proc/9/cmdline | N/A | N/A |
| File opened for reading | /proc/24/cmdline | N/A | N/A |
| File opened for reading | /proc/676/cmdline | N/A | N/A |
| File opened for reading | /proc/678/cmdline | N/A | N/A |
| File opened for reading | /proc/723/cmdline | N/A | N/A |
| File opened for reading | /proc/748/cmdline | N/A | N/A |
| File opened for reading | /proc/775/cmdline | N/A | N/A |
| File opened for reading | /proc/682/cmdline | N/A | N/A |
| File opened for reading | /proc/687/cmdline | N/A | N/A |
| File opened for reading | /proc/711/cmdline | N/A | N/A |
| File opened for reading | /proc/714/cmdline | N/A | N/A |
| File opened for reading | /proc/735/cmdline | N/A | N/A |
| File opened for reading | /proc/738/cmdline | N/A | N/A |
| File opened for reading | /proc/752/cmdline | N/A | N/A |
| File opened for reading | /proc/774/cmdline | N/A | N/A |
| File opened for reading | /proc/785/cmdline | N/A | N/A |
| File opened for reading | /proc/313/cmdline | N/A | N/A |
| File opened for reading | /proc/708/cmdline | N/A | N/A |
| File opened for reading | /proc/755/cmdline | N/A | N/A |
| File opened for reading | /proc/771/cmdline | N/A | N/A |
| File opened for reading | /proc/41/cmdline | N/A | N/A |
| File opened for reading | /proc/42/cmdline | N/A | N/A |
| File opened for reading | /proc/289/cmdline | N/A | N/A |
| File opened for reading | /proc/759/cmdline | N/A | N/A |
| File opened for reading | /proc/786/cmdline | N/A | N/A |
| File opened for reading | /proc/793/cmdline | N/A | N/A |
| File opened for reading | /proc/288/cmdline | N/A | N/A |
| File opened for reading | /proc/681/cmdline | N/A | N/A |
| File opened for reading | /proc/691/cmdline | N/A | N/A |
| File opened for reading | /proc/5/cmdline | N/A | N/A |
| File opened for reading | /proc/14/cmdline | N/A | N/A |
| File opened for reading | /proc/17/cmdline | N/A | N/A |
| File opened for reading | /proc/677/cmdline | N/A | N/A |
| File opened for reading | /proc/683/cmdline | N/A | N/A |
| File opened for reading | /proc/694/cmdline | N/A | N/A |
| File opened for reading | /proc/702/cmdline | N/A | N/A |
| File opened for reading | /proc/742/cmdline | N/A | N/A |
| File opened for reading | /proc/767/cmdline | N/A | N/A |
| File opened for reading | /proc/770/cmdline | N/A | N/A |
| File opened for reading | /proc/776/cmdline | N/A | N/A |
| File opened for reading | /proc/777/cmdline | N/A | N/A |
| File opened for reading | /proc/792/cmdline | N/A | N/A |
| File opened for reading | /proc/8/cmdline | N/A | N/A |
| File opened for reading | /proc/27/cmdline | N/A | N/A |
| File opened for reading | /proc/107/cmdline | N/A | N/A |
| File opened for reading | /proc/293/cmdline | N/A | N/A |
| File opened for reading | /proc/323/cmdline | N/A | N/A |
| File opened for reading | /proc/649/cmdline | N/A | N/A |
| File opened for reading | /proc/685/cmdline | N/A | N/A |
| File opened for reading | /proc/703/cmdline | N/A | N/A |
| File opened for reading | /proc/715/cmdline | N/A | N/A |
| File opened for reading | /proc/729/cmdline | N/A | N/A |
| File opened for reading | /proc/749/cmdline | N/A | N/A |
| File opened for reading | /proc/760/cmdline | N/A | N/A |
| File opened for reading | /proc/6/cmdline | N/A | N/A |
| File opened for reading | /proc/292/cmdline | N/A | N/A |
| File opened for reading | /proc/662/cmdline | N/A | N/A |
Processes
/tmp/f7f1973f6160bb4251ea95ebd1c3a5e6ef39c28a1a98e40aef7542b4daeb80a0.elf
[/tmp/f7f1973f6160bb4251ea95ebd1c3a5e6ef39c28a1a98e40aef7542b4daeb80a0.elf]
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | lon.vani.ovh | udp |
| VN | 14.225.219.227:42597 | lon.vani.ovh | tcp |
| US | 8.8.8.8:53 | lon.vani.ovh | udp |
| VN | 14.225.219.227:42597 | lon.vani.ovh | tcp |
| US | 8.8.8.8:53 | lon.vani.ovh | udp |
| VN | 14.225.219.227:42597 | lon.vani.ovh | tcp |
| US | 8.8.8.8:53 | lon.vani.ovh | udp |
| VN | 14.225.219.227:42597 | lon.vani.ovh | tcp |
| US | 8.8.8.8:53 | lon.vani.ovh | udp |
| VN | 14.225.219.227:42597 | lon.vani.ovh | tcp |
| IN | 20.219.76.241:23287 | udp |
Files
N/A