mirai | 713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50

General

Target

0e03e44523fea525ebc0bb6fa81b8c52.elf
Size

22KB
MD5

0e03e44523fea525ebc0bb6fa81b8c52
SHA1

e046a338fea8dedd45934eeb479fd44d1258051d
SHA256

713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50
SHA512

df6b2e9218759d4601af742be35683485d2da2f8c53d701741524d04bf1d9a1ce2a740c7707bb1843e7f77d1278ab576419b580d1490926ab2b693c78ab9bed0
SSDEEP

384:gFYfwf/izXcR3fivuQUhJX9tDttu0fOM9Yx/DmpO5wuHnrbV8YSqcKsDScN2lM5N:QikKzXctauJX9t+WO5lCpUdvONqyScN/

Score

10^/10

mirai lzrd botnet

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

0e03e44523fea525ebc0bb6fa81b8c52.elf

description	ioc	process
File opened for modification	/dev/watchdog	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for modification	/dev/misc/watchdog	0e03e44523fea525ebc0bb6fa81b8c52.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

Processes:

0e03e44523fea525ebc0bb6fa81b8c52.elf

description	ioc	process
File opened for modification	/sbin/watchdog	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for modification	/bin/watchdog	0e03e44523fea525ebc0bb6fa81b8c52.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

0e03e44523fea525ebc0bb6fa81b8c52.elf

description	ioc	process
File opened for reading	/proc/608/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/685/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/463/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/541/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1147/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1542/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/972/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1094/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1328/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/523/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1070/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1084/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1160/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1202/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1361/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/723/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1618/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/913/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1026/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/489/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/534/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1152/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/575/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/609/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1021/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1176/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1348/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/454/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/521/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1163/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1576/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1600/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1120/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1255/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1314/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1351/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1624/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1098/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1475/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1606/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/960/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1166/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/490/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/558/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1056/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1078/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1293/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1537/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/687/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/719/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1196/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1239/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1139/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1375/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/416/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1284/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1570/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/453/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1131/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1156/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1193/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1452/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1536/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf
File opened for reading	/proc/1050/cmdline	0e03e44523fea525ebc0bb6fa81b8c52.elf

/tmp/0e03e44523fea525ebc0bb6fa81b8c52.elf
/tmp/0e03e44523fea525ebc0bb6fa81b8c52.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1539