Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
-
submitted
24-04-2024 01:20
General
-
Target
620c15ed6f68b42d2a3b708c340d9ccff7a9217f49ff11effabad58821c7c08a.elf
-
Size
29KB
-
MD5
d15e0d59fb573bd3fed0126bf434b982
-
SHA1
01a748696ac1eb2b85a8297ead29af408ef3f017
-
SHA256
620c15ed6f68b42d2a3b708c340d9ccff7a9217f49ff11effabad58821c7c08a
-
SHA512
983d42704a79f664d44c6712bb8dc608a29a96cf1b0211dd9c4cc6a7ccd59c04c10f57a077033ca53df08cde90efe11957ee721c4d4a5388c27a695dc31ae7d0
-
SSDEEP
768:5KpROfidrsa6Uq4sn9Fp1Sr+OqDUM8sH9o+eI:5Kpk6doaxun0+OqD/8s2+V
Score
10/10
Malware Config
Extracted
Family
mirai
C2
spagetti.openproxylist.info
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Deletes itself 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Traces itself 1 IoCs
Traces itself to prevent debugging attempts
-
Writes file to system bin folder 1 TTPs 2 IoCs
-
Changes its process name 1 IoCs
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/620c15ed6f68b42d2a3b708c340d9ccff7a9217f49ff11effabad58821c7c08a.elf/tmp/620c15ed6f68b42d2a3b708c340d9ccff7a9217f49ff11effabad58821c7c08a.elf1⤵
- Deletes itself
- Modifies Watchdog functionality
- Traces itself
- Writes file to system bin folder
- Changes its process name
- Reads runtime system information
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1464-1-0x0000000008048000-0x0000000008058900-memory.dmp