mirai | e73631262ad5baa136ef67f9bb39ec6b47fed190d96a2d5db28017f600a08984 | Triage

Sharing

General

Target

1528-1-0x0000000008048000-0x00000000080558e8-memory.dmp
Size

52KB
Sample

240503-dbwrfsfd55
MD5

de86080c20bf2d089423fe37063dbd61
SHA1

ebada8f52a76c0287a5a5a0426fa3ca0cdb4b6e0
SHA256

e73631262ad5baa136ef67f9bb39ec6b47fed190d96a2d5db28017f600a08984
SHA512

b17bd59e154c461c8048002dd29e281892a3d1437b5fc6e0c9098eb256e6e474c2b6f3ccb01c94d04e9fb92978be1bb1fa445d011abc3141315b35f6a32a4a7c
SSDEEP

768:uGpjM9WF9ln3Hi8WX1gVHVMcV7gowbBnOvoElEb454v1wyzT0IOCP/OPVzI5vsr:uGp2kln3Hi76V1yy3K9w8DePVc50r

Score

10^/10

mirai lzrd linux

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

- Target
  
  1528-1-0x0000000008048000-0x00000000080558e8-memory.dmp
- Size
  
  52KB
- MD5
  
  de86080c20bf2d089423fe37063dbd61
- SHA1
  
  ebada8f52a76c0287a5a5a0426fa3ca0cdb4b6e0
- SHA256
  
  e73631262ad5baa136ef67f9bb39ec6b47fed190d96a2d5db28017f600a08984
- SHA512
  
  b17bd59e154c461c8048002dd29e281892a3d1437b5fc6e0c9098eb256e6e474c2b6f3ccb01c94d04e9fb92978be1bb1fa445d011abc3141315b35f6a32a4a7c
- SSDEEP
  
  768:uGpjM9WF9ln3Hi8WX1gVHVMcV7gowbBnOvoElEb454v1wyzT0IOCP/OPVzI5vsr:uGp2kln3Hi76V1yy3K9w8DePVc50r
Score

7^/10
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Enumerates running processes
  Discovers information about currently running processes on the system
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Impair Defenses

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1