mirai | 35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c

General

Target

35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
Size

20KB
MD5

c840de42fe49288f8c4d2cd2472e120e
SHA1

5391a85e8bf86891da6bbfcd62c659d824b51aff
SHA256

35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c
SHA512

f19e21bfbc8cfa24c5c3002de3e8e37a5b4dae6d9cda7291114e53dfc955a8f7349364f1591d00dea1e298ba23f110a6a77da04b38c04287635ceafd65283603
SSDEEP

384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTL:798o08kxofBE+ZkXaITbp2F2TWul0c5H

Score

10^/10

mirai lzrd botnet

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf

description	ioc	process
File opened for modification	/dev/watchdog	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for modification	/dev/misc/watchdog	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

Processes:

35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf

description	ioc	process
File opened for modification	/bin/watchdog	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for modification	/sbin/watchdog	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf

description	ioc	process
File opened for reading	/proc/574/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/686/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1174/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1342/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1593/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1617/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/497/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/948/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1268/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/553/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1491/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1557/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1635/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1145/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/977/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/489/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/478/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1358/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1190/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/652/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1038/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1534/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/432/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1087/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1162/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/982/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/499/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1171/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/492/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/589/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1033/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1109/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1647/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/486/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/476/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1207/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1567/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1599/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/467/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1183/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/564/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/988/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1176/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1209/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1332/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1384/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/472/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/984/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1559/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/670/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1058/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1272/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1558/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1605/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/617/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1314/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1168/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/484/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1081/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1091/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1141/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1560/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/1579/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
File opened for reading	/proc/425/cmdline	35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf

/tmp/35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
/tmp/35214ea68169439bc3ea2d7efc695abf8862ef6a097ff405c9f9dd3bcd9e017c.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1563