mirai | 5b2f8e94ad3ab35d9a7f437f606fca6e95b5ee56cf73099ec94645d6a564d063

Analysis

max time kernel
148s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
28-06-2024 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d836679208b117e6fa65c99291e76f2.elf
Size

24KB
MD5

5d836679208b117e6fa65c99291e76f2
SHA1

b5e654af683dde3f4037595b1726062de4e50cde
SHA256

5b2f8e94ad3ab35d9a7f437f606fca6e95b5ee56cf73099ec94645d6a564d063
SHA512

bc45011a12a88571b298391c7848d35b687475a73ad46b110b4fe743c2f2589ef7d38a8810b644f21227de1db832888a0d5c707d8b1162f37dd96a2c01ce6ee7
SSDEEP

384:yBO/rinPfI/g+r3qdt46KnVdrybYytI2z70H4hAa7FRvnxH8tGvqqTpGkzLJd1RW:yO2k2t3wTyBQYhFNxudkzLJd1Rs3UozP

Score

10^/10

mirai botnet discovery

Malware Config

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (9213) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	sshd	632	5d836679208b117e6fa65c99291e76f2.elf

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/exe	5d836679208b117e6fa65c99291e76f2.elf

Writes file to tmp directory 9 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/5$3'1$384?7P	5d836679208b117e6fa65c99291e76f2.elf
File opened for modification	/tmp/45&'1$384?7P	5d836679208b117e6fa65c99291e76f2.elf
File opened for modification	/tmp/#29>'1$384?7P	5d836679208b117e6fa65c99291e76f2.elf
File opened for modification	/tmp/45&a`a'1$384?7P	5d836679208b117e6fa65c99291e76f2.elf
File opened for modification	/tmp/45&'1$384?7`P	5d836679208b117e6fa65c99291e76f2.elf
File opened for modification	/tmp/5$34561%<$'1$384?7P	5d836679208b117e6fa65c99291e76f2.elf
File opened for modification	/tmp/45&=9#3'1$384?7P	5d836679208b117e6fa65c99291e76f2.elf
File opened for modification	/tmp/29>'1$384?7P	5d836679208b117e6fa65c99291e76f2.elf
File opened for modification	/tmp/45&a`a'1$384?7P	5d836679208b117e6fa65c99291e76f2.elf

/tmp/5d836679208b117e6fa65c99291e76f2.elf
/tmp/5d836679208b117e6fa65c99291e76f2.elf
1⤵
- Changes its process name
- Reads runtime system information
- Writes file to tmp directory
PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/632-1-0x00008000-0x0001ff84-memory.dmp

Download