Analysis
-
max time kernel
149s -
max time network
150s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
21-07-2024 18:26
General
-
Target
b0b0f87e748ba4842aa5020739b4007c.elf
-
Size
48KB
-
MD5
b0b0f87e748ba4842aa5020739b4007c
-
SHA1
4444a298b2d2173ba904a5f98628db624f6316dd
-
SHA256
4a1934d87decdfad56645d354bd208458619c8281f3bec5a161406811c3ed032
-
SHA512
c36923770bc3d29f72dbddec71a61ff65c7c20d62bf380ff6d339f2fd6aead2fe19a5727234e017c0759e98d4bcb3220075104de62caebcdf20db5e497abb0ed
-
SSDEEP
1536:CW8sypfAA6EgIPi6Li/e1N0c4nsVJuUm5sK8:CppoAPgf6OuVQUm5f8
Malware Config
Extracted
Family
mirai
Botnet
MIRAI
Signatures
-
Deletes itself 1 IoCs
Processes:
b0b0f87e748ba4842aa5020739b4007c.elfpid process 735 b0b0f87e748ba4842aa5020739b4007c.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
b0b0f87e748ba4842aa5020739b4007c.elfdescription ioc process File opened for modification /dev/watchdog b0b0f87e748ba4842aa5020739b4007c.elf File opened for modification /dev/misc/watchdog b0b0f87e748ba4842aa5020739b4007c.elf -
Changes its process name 1 IoCs
Processes:
b0b0f87e748ba4842aa5020739b4007c.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself w7vhmg67bvvi 735 b0b0f87e748ba4842aa5020739b4007c.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
b0b0f87e748ba4842aa5020739b4007c.elfdescription ioc process File opened for reading /proc/72cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/751cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/796cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/8cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/36cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/364cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/753cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/754cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/769cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/794cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/839cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/7cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/9cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/840cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/20cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/758cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/764cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/825cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/4cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/17cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/772cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/776cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/781cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/808cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/763cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/766cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/824cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/770cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/774cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/786cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/809cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/391cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/748cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/822cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/161cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/674cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/381cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/734cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/755cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/802cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/23cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/74cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/762cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/820cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/677cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/730cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/798cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/815cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/838cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/332cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/756cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/681cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/740cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/749cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/773cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/5cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/78cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/14cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/780cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/784cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/793cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/811cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/812cmdline b0b0f87e748ba4842aa5020739b4007c.elf File opened for reading /proc/1cmdline b0b0f87e748ba4842aa5020739b4007c.elf
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/735-1-0x00400000-0x0042d9e0-memory.dmp