mirai | 29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7

General

Target

29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
Size

25KB
MD5

4f6cf0b40a415773ca13429a35d828e5
SHA1

7c215ea3900aeffcf0658ac55168ae1556db3785
SHA256

29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7
SHA512

022a23b6c40164a7d669b30b3adf806b3ec122e62180fcb0bd45f7786fcf89ee0c9cf014e018d29341dcb8f21a1b713070e5efc98b95d86fc86dd15e1180b551
SSDEEP

768:VVVhKh+3d5fe3DhgLi/9ib4Ce1rx2YpJlrsYN:h4OvfeTh9NrlAYN

Score

10^/10

mirai lzrd botnet

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf

description	ioc	process
File opened for modification	/dev/watchdog	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for modification	/dev/misc/watchdog	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

Processes:

29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf

description	ioc	process
File opened for modification	/bin/watchdog	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for modification	/sbin/watchdog	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf

description	ioc	process
File opened for reading	/proc/1028/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1159/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/522/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1584/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/611/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/710/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/937/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1094/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1113/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1358/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1552/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1608/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/546/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/688/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1131/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1202/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1266/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/681/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1541/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1590/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/612/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1066/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/669/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/726/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1155/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1267/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1596/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/463/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/558/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/451/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1614/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/957/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1076/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1535/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1235/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1123/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1578/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1033/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1148/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1183/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1195/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/469/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1332/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1558/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1191/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1315/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1194/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/499/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1620/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/473/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1152/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1626/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1135/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/658/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/676/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/478/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/969/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1070/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1090/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1175/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1287/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1471/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/577/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
File opened for reading	/proc/1311/cmdline	29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf

/tmp/29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
/tmp/29642627d91e46c9521d796f37b06af53ce26ccaa79b6a531c4646d8eb0a0bb7.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1537