mirai | 7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d | Triage

Sharing

General

Target

7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
Size

25KB
Sample

240522-cbbkvagg8w
MD5

0ce11a51aac0f5f41a0f982d2722170c
SHA1

c6528a11bbeff20da3ee025a72329dc094b4359b
SHA256

7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d
SHA512

e04db3cc89dae8e2c59583538d83d1c25eeea2114e455916520f2a17b6757926cfa3e2ce2a069d22a91e387a5a04c0b13ead16ceacf55419d63a2485ca52b9e8
SSDEEP

768:moyibKW9QwY4o/JJVpDCX14al4i+RUhmNuM4:moXbsR/JJ+l4alkwmUM4

Score

10^/10

mirai lzrd botnet linux upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

- Target
  
  7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
- Size
  
  25KB
- MD5
  
  0ce11a51aac0f5f41a0f982d2722170c
- SHA1
  
  c6528a11bbeff20da3ee025a72329dc094b4359b
- SHA256
  
  7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d
- SHA512
  
  e04db3cc89dae8e2c59583538d83d1c25eeea2114e455916520f2a17b6757926cfa3e2ce2a069d22a91e387a5a04c0b13ead16ceacf55419d63a2485ca52b9e8
- SSDEEP
  
  768:moyibKW9QwY4o/JJVpDCX14al4i+RUhmNuM4:moXbsR/JJ+l4alkwmUM4
Score

10^/10

mirai lzrd botnet
- Mirai
  Mirai is a prevalent Linux malware infecting exposed network devices.
  botnet mirai
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Enumerates running processes
  Discovers information about currently running processes on the system
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Impair Defenses

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

mirailzrdbotnet