mirai | 713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50

General

Target

713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
Size

22KB
MD5

0e03e44523fea525ebc0bb6fa81b8c52
SHA1

e046a338fea8dedd45934eeb479fd44d1258051d
SHA256

713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50
SHA512

df6b2e9218759d4601af742be35683485d2da2f8c53d701741524d04bf1d9a1ce2a740c7707bb1843e7f77d1278ab576419b580d1490926ab2b693c78ab9bed0
SSDEEP

384:gFYfwf/izXcR3fivuQUhJX9tDttu0fOM9Yx/DmpO5wuHnrbV8YSqcKsDScN2lM5N:QikKzXctauJX9t+WO5lCpUdvONqyScN/

Score

10^/10

mirai lzrd botnet

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf

description	ioc	process
File opened for modification	/dev/watchdog	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for modification	/dev/misc/watchdog	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

Processes:

713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf

description	ioc	process
File opened for modification	/sbin/watchdog	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for modification	/bin/watchdog	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf

description	ioc	process
File opened for reading	/proc/1090/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1415/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1474/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1854/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/488/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1084/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/604/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/893/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1414/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/451/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/806/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/925/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/926/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1029/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1966/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/639/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/554/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1411/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1931/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/2025/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/453/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1024/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1113/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1136/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1151/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/777/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/675/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/812/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1313/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1417/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1453/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1482/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/500/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/969/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1965/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/558/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/626/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/933/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1101/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/529/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/466/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/475/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1002/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1105/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1234/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1412/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/452/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/889/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1056/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1095/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1475/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1477/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1510/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1970/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/602/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1122/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1418/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1514/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1967/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1969/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/494/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1078/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1081/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
File opened for reading	/proc/1961/cmdline	713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf

/tmp/713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
/tmp/713a91572aa251c96bb0bc24a0a0a817d05d8baf127971006b67c77366458b50.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1478