Malware Analysis Report

2024-10-10 11:06

Sample ID 240703-c2575stajh
Target ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf
SHA256 ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f
Tags
mirai mirai
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f

Threat Level: Known bad

The file ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf was found to be: Known bad.

Malicious Activity Summary

mirai mirai

Mirai family

Deletes itself

Modifies Watchdog functionality

Enumerates active TCP sockets

Enumerates running processes

Changes its process name

Reads system network configuration

Reads runtime system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-03 02:35

Signatures

Mirai family

mirai

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-03 02:35

Reported

2024-07-03 02:37

Platform

ubuntu2204-amd64-20240522.1-en

Max time kernel

149s

Max time network

150s

Command Line

[/tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf]

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A

Modifies Watchdog functionality

Description Indicator Process Target
File opened for modification /dev/watchdog /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for modification /dev/misc/watchdog /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A

Enumerates active TCP sockets

Description Indicator Process Target
File opened for reading /proc/net/tcp /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A

Enumerates running processes

Changes its process name

Description Indicator Process Target
Changes the process name, possibly in an attempt to hide itself N/A /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A

Reads system network configuration

Description Indicator Process Target
File opened for reading /proc/net/tcp /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A

Reads runtime system information

Description Indicator Process Target
File opened for reading /proc/1155/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/527/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1124/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/841/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1217/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1357/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1371/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/593/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/636/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/587/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/669/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/843/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/991/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/412/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/504/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1158/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/452/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1078/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/775/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1032/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1052/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1110/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1169/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/588/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/749/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1096/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1156/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1223/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/701/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/962/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1161/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1163/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1177/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/979/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1142/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1073/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1179/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1317/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1043/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1157/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1114/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/585/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1080/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/592/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/956/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1037/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1175/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1569/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1012/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1378/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1564/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/765/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1170/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/748/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1449/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/737/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/741/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/783/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/865/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1244/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1288/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/414/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/770/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A
File opened for reading /proc/1199/exe /tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf N/A

Processes

/tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf

[/tmp/ca66e7e3b88774b516cdb586873f168b21ef248db92a3497201669cbd801d28f.elf]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 65.222.202.53:80 tcp
US 65.222.202.53:80 tcp
US 65.222.202.53:80 tcp
US 65.222.202.53:80 tcp
US 65.222.202.53:80 tcp
US 65.222.202.53:80 tcp
US 65.222.202.53:80 tcp
US 65.222.202.53:80 tcp
US 65.222.202.53:80 tcp
US 65.222.202.53:80 tcp
US 65.222.202.53:80 tcp
US 65.222.202.53:80 tcp
US 65.222.202.53:80 tcp
US 65.222.202.53:80 tcp

Files

N/A