mirai | 7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d

General

Target

7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
Size

25KB
MD5

0ce11a51aac0f5f41a0f982d2722170c
SHA1

c6528a11bbeff20da3ee025a72329dc094b4359b
SHA256

7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d
SHA512

e04db3cc89dae8e2c59583538d83d1c25eeea2114e455916520f2a17b6757926cfa3e2ce2a069d22a91e387a5a04c0b13ead16ceacf55419d63a2485ca52b9e8
SSDEEP

768:moyibKW9QwY4o/JJVpDCX14al4i+RUhmNuM4:moXbsR/JJ+l4alkwmUM4

Score

10^/10

mirai lzrd botnet

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf

description	ioc	process
File opened for modification	/dev/watchdog	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for modification	/dev/misc/watchdog	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

Processes:

7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf

description	ioc	process
File opened for modification	/sbin/watchdog	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for modification	/bin/watchdog	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf

description	ioc	process
File opened for reading	/proc/1401/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/441/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1024/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1076/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1208/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/682/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/962/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/484/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1135/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1320/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/539/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1075/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/498/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/617/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/795/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1038/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/579/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/935/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1079/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1442/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/927/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/455/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/519/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/586/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/793/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/485/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1078/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1294/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1125/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1122/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/668/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/801/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1055/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1099/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/686/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/754/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/922/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1106/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1405/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/523/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/581/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1065/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1074/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/664/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/776/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/926/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1400/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/497/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1335/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/521/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/946/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/951/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1114/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/501/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/573/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1080/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1399/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/451/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/591/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/832/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/974/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/502/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/506/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
File opened for reading	/proc/1082/cmdline	7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf

/tmp/7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
/tmp/7e8f5152c7b46a89e288020a288d463dd2cc7258a2dae839cd17d91f8a4fa83d.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1402