mirai | 86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf

General

Target

86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
Size

24KB
MD5

bd52e0ed8e0b0880f6f8650fdf31a45b
SHA1

764b6909d562f09a997e26b658d68625e07cc9f7
SHA256

86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf
SHA512

9be052a1fe960efb52163e8a2d3138aa8fca66b18372a7a79689398ff1e451a503a046ff22c8cf46873b38236490279d83b1f7102376f702a924bc80636875f8
SSDEEP

768:5Qu5Va7FXydihUArB/2uc4gViw/EGFSwxxREVUe:iu+7FX0kU2B/Bg3zjxxREVJ

Score

10^/10

mirai lzrd botnet

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf

description	ioc	process
File opened for modification	/dev/watchdog	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for modification	/dev/misc/watchdog	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

Processes:

86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf

description	ioc	process
File opened for modification	/sbin/watchdog	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for modification	/bin/watchdog	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf

description	ioc	process
File opened for reading	/proc/1082/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1149/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/808/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/814/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1128/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1095/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1121/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/403/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/446/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/568/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/957/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/970/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1027/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1090/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1182/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1183/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/452/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/491/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/538/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/806/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/865/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1088/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/481/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/629/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/856/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1041/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/800/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/805/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1045/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1070/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1089/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1409/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1109/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/461/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/657/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/673/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1098/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/541/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/987/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1334/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/462/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/698/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1258/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/681/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/963/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1002/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/652/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/951/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1037/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1097/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1124/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1407/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/524/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/565/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1079/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/507/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/860/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1351/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/554/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/788/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/993/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/694/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/1107/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
File opened for reading	/proc/508/cmdline	86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf

/tmp/86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
/tmp/86fb9cd7b19cb7a88cd7eae579d2656331110b296e40a535010affc6ce3b86cf.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1411