Analysis Overview
score
10/10
SHA256
136415a68341ba2706982ecd53af6531d5fe2bead73f5f6c42cd66f08a28327a
Threat Level: Known bad
The file 136415a68341ba2706982ecd53af6531d5fe2bead73f5f6c42cd66f08a28327a.elf was found to be: Known bad.
Malicious Activity Summary
Mirai family
Changes its process name
Enumerates running processes
Reads runtime system information
MITRE ATT&CK
N/A
Analysis: static1
Detonation Overview
Reported
2024-04-19 12:00
Signatures
Mirai family
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-19 12:00
Reported
2024-04-19 12:03
Platform
debian12-mipsel-20240221-en
Max time kernel
150s
Max time network
155s
Command Line
[/tmp/136415a68341ba2706982ecd53af6531d5fe2bead73f5f6c42cd66f08a28327a.elf]
Signatures
Changes its process name
| Description | Indicator | Process | Target |
| Changes the process name, possibly in an attempt to hide itself | a- M"! | /tmp/136415a68341ba2706982ecd53af6531d5fe2bead73f5f6c42cd66f08a28327a.elf | N/A |
Enumerates running processes
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/380/cmdline | N/A | N/A |
| File opened for reading | /proc/785/cmdline | N/A | N/A |
| File opened for reading | /proc/746/cmdline | N/A | N/A |
| File opened for reading | /proc/747/cmdline | N/A | N/A |
| File opened for reading | /proc/786/cmdline | N/A | N/A |
| File opened for reading | /proc/740/cmdline | N/A | N/A |
| File opened for reading | /proc/11/cmdline | N/A | N/A |
| File opened for reading | /proc/20/cmdline | N/A | N/A |
| File opened for reading | /proc/31/cmdline | N/A | N/A |
| File opened for reading | /proc/118/cmdline | N/A | N/A |
| File opened for reading | /proc/694/cmdline | N/A | N/A |
| File opened for reading | /proc/710/cmdline | N/A | N/A |
| File opened for reading | /proc/726/cmdline | N/A | N/A |
| File opened for reading | /proc/748/cmdline | N/A | N/A |
| File opened for reading | /proc/763/cmdline | N/A | N/A |
| File opened for reading | /proc/775/cmdline | N/A | N/A |
| File opened for reading | /proc/15/cmdline | N/A | N/A |
| File opened for reading | /proc/16/cmdline | N/A | N/A |
| File opened for reading | /proc/116/cmdline | N/A | N/A |
| File opened for reading | /proc/749/cmdline | N/A | N/A |
| File opened for reading | /proc/757/cmdline | N/A | N/A |
| File opened for reading | /proc/8/cmdline | N/A | N/A |
| File opened for reading | /proc/9/cmdline | N/A | N/A |
| File opened for reading | /proc/14/cmdline | N/A | N/A |
| File opened for reading | /proc/48/cmdline | N/A | N/A |
| File opened for reading | /proc/736/cmdline | N/A | N/A |
| File opened for reading | /proc/13/cmdline | N/A | N/A |
| File opened for reading | /proc/33/cmdline | N/A | N/A |
| File opened for reading | /proc/750/cmdline | N/A | N/A |
| File opened for reading | /proc/22/cmdline | N/A | N/A |
| File opened for reading | /proc/711/cmdline | N/A | N/A |
| File opened for reading | /proc/737/cmdline | N/A | N/A |
| File opened for reading | /proc/29/cmdline | N/A | N/A |
| File opened for reading | /proc/37/cmdline | N/A | N/A |
| File opened for reading | /proc/390/cmdline | N/A | N/A |
| File opened for reading | /proc/691/cmdline | N/A | N/A |
| File opened for reading | /proc/762/cmdline | N/A | N/A |
| File opened for reading | /proc/396/cmdline | N/A | N/A |
| File opened for reading | /proc/720/cmdline | N/A | N/A |
| File opened for reading | /proc/772/cmdline | N/A | N/A |
| File opened for reading | /proc/776/cmdline | N/A | N/A |
| File opened for reading | /proc/137/cmdline | N/A | N/A |
| File opened for reading | /proc/744/cmdline | N/A | N/A |
| File opened for reading | /proc/2/cmdline | N/A | N/A |
| File opened for reading | /proc/112/cmdline | N/A | N/A |
| File opened for reading | /proc/181/cmdline | N/A | N/A |
| File opened for reading | /proc/754/cmdline | N/A | N/A |
| File opened for reading | /proc/666/cmdline | N/A | N/A |
| File opened for reading | /proc/688/cmdline | N/A | N/A |
| File opened for reading | /proc/725/cmdline | N/A | N/A |
| File opened for reading | /proc/743/cmdline | N/A | N/A |
| File opened for reading | /proc/781/cmdline | N/A | N/A |
| File opened for reading | /proc/17/cmdline | N/A | N/A |
| File opened for reading | /proc/731/cmdline | N/A | N/A |
| File opened for reading | /proc/732/cmdline | N/A | N/A |
| File opened for reading | /proc/727/cmdline | N/A | N/A |
| File opened for reading | /proc/742/cmdline | N/A | N/A |
| File opened for reading | /proc/21/cmdline | N/A | N/A |
| File opened for reading | /proc/27/cmdline | N/A | N/A |
| File opened for reading | /proc/733/cmdline | N/A | N/A |
| File opened for reading | /proc/779/cmdline | N/A | N/A |
| File opened for reading | /proc/7/cmdline | N/A | N/A |
| File opened for reading | /proc/28/cmdline | N/A | N/A |
| File opened for reading | /proc/53/cmdline | N/A | N/A |
Processes
/tmp/136415a68341ba2706982ecd53af6531d5fe2bead73f5f6c42cd66f08a28327a.elf
[/tmp/136415a68341ba2706982ecd53af6531d5fe2bead73f5f6c42cd66f08a28327a.elf]
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | bn.networkbn.click | udp |
| VN | 103.167.88.226:43957 | bn.networkbn.click | tcp |
| US | 1.1.1.1:53 | debian12-mipsel-20240221-en-1 | udp |
| US | 1.1.1.1:53 | debian12-mipsel-20240221-en-1 | udp |
| US | 1.1.1.1:53 | debian12-mipsel-20240221-en-1 | udp |
| US | 1.1.1.1:53 | debian12-mipsel-20240221-en-1 | udp |
Files
N/A