mirai | 0c1b3b5095a7badf2b1b9053acdf282c6d34c3a25728078fb052fd9a39a4ff07

General

Target

8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
Size

32KB
MD5

1d1f24ad1b03a989293b1fad697a7d58
SHA1

b5cce199cc0c3154935df74a14662c8d5bfec4c0
SHA256

8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0
SHA512

6b7dbbd1cfa2f9c5cb5f6883a94f863eaaec4fdadcc09d29e2a918ead51a97b07e361d0f37c74cabe6d677c34a4e5046faa324e23fe296a78428b8f9fd5ae8c8
SSDEEP

768:lBscAALmcIyhrSp0I4Hu//RoY2YNmWpgZkq0trMF:lBR/4F0Hu//StYNmWpgSts

Score

10^/10

mirai lzrd botnet

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf

description	ioc	process
File opened for modification	/dev/misc/watchdog	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for modification	/dev/watchdog	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

Processes:

8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf

description	ioc	process
File opened for modification	/sbin/watchdog	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for modification	/bin/watchdog	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf

description	ioc	process
File opened for reading	/proc/1300/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1549/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/558/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1071/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1085/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1200/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/960/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1451/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1023/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1177/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1351/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1123/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1080/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1248/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1265/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/436/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/543/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/686/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/740/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1353/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/752/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1153/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1202/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1325/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1617/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/493/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/552/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1176/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1536/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/978/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1593/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1629/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1364/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1569/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/423/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1095/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1179/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1330/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/619/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1028/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1623/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/517/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1267/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1535/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1198/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1518/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1533/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1611/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1188/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1587/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1158/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1162/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/512/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/969/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1099/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1108/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1309/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/508/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/974/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1075/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1144/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/1207/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/444/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
File opened for reading	/proc/484/cmdline	8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf

/tmp/8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
/tmp/8dda7f99fc5c348bccd5f66d423dc0dc6ee69b5fb65837dd0a786ab9a00fc6a0.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1539