mirai | 86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf

General

Target

86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
Size

24KB
MD5

bd52e0ed8e0b0880f6f8650fdf31a45b
SHA1

764b6909d562f09a997e26b658d68625e07cc9f7
SHA256

86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf
SHA512

9be052a1fe960efb52163e8a2d3138aa8fca66b18372a7a79689398ff1e451a503a046ff22c8cf46873b38236490279d83b1f7102376f702a924bc80636875f8
SSDEEP

768:5Qu5Va7FXydihUArB/2uc4gViw/EGFSwxxREVUe:iu+7FX0kU2B/Bg3zjxxREVJ

Score

10^/10

mirai lzrd botnet

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf

description	ioc	process
File opened for modification	/dev/misc/watchdog	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for modification	/dev/watchdog	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

Processes:

86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf

description	ioc	process
File opened for modification	/sbin/watchdog	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for modification	/bin/watchdog	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf

description	ioc	process
File opened for reading	/proc/536/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1094/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/559/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/496/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/992/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1085/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/673/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/560/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/620/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1095/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/802/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/996/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1005/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/646/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/953/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1024/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1067/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1087/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1090/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/440/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/549/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/761/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/855/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/809/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/862/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1114/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/796/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/959/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1042/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1109/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1394/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/470/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/490/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/534/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1080/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1104/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1046/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/457/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/693/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/800/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1086/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1202/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/456/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/668/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1055/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1130/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1330/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/454/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/675/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/850/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/924/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/967/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1180/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1029/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1242/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1034/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1101/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1106/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/441/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/982/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1125/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/501/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/650/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/783/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf

/tmp/86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
/tmp/86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1391