Analysis
-
max time kernel
154s -
max time network
166s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
22-07-2024 00:06
General
-
Target
d308611c459eb18bd3d7391f76beba1d.elf
-
Size
36KB
-
MD5
d308611c459eb18bd3d7391f76beba1d
-
SHA1
66d1002b6fa5dabdf817e35a22a3ae9765e2cce4
-
SHA256
9a01f605497a1a40e7afbd45817f0766cbe4f933003336c5da3b44d9e36a8025
-
SHA512
2e5168675892c8cdd35a57fae8d1913331446dd65ab8c07d08c5af22747f704f0593e5dd697420f0900f955cefd5be439d465c6a24c991a0137de77131a551df
-
SSDEEP
768:Bcic7wjLhjwmdpL2DUu0tqa/Q3czyKjdTJ3vbcBroEKDPNWG:WqVLgUATc7dlYFoEKV
Malware Config
Extracted
Family
mirai
Botnet
MIRAI
Signatures
-
Deletes itself 1 IoCs
Processes:
d308611c459eb18bd3d7391f76beba1d.elfpid process 740 d308611c459eb18bd3d7391f76beba1d.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
d308611c459eb18bd3d7391f76beba1d.elfdescription ioc process File opened for modification /dev/watchdog d308611c459eb18bd3d7391f76beba1d.elf File opened for modification /dev/misc/watchdog d308611c459eb18bd3d7391f76beba1d.elf -
Changes its process name 1 IoCs
Processes:
d308611c459eb18bd3d7391f76beba1d.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself r56gnkohsgnsrgwpwodh 740 d308611c459eb18bd3d7391f76beba1d.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
d308611c459eb18bd3d7391f76beba1d.elfdescription ioc process File opened for reading /proc/787cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/15cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/731cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/58cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/751cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/768cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/1cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/9cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/33cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/114cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/17cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/24cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/42cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/119cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/12cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/37cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/411cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/758cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/3cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/138cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/770cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/786cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/19cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/35cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/656cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/404cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/705cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/757cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/29cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/387cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/20cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/111cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/710cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/783cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/4cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/5cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/334cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/734cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/14cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/27cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/775cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/8cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/742cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/769cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/23cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/110cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/746cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/755cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/763cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/772cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/774cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/7cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/181cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/388cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/748cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/765cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/32cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/48cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/780cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/28cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/325cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/116cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/11cmdline d308611c459eb18bd3d7391f76beba1d.elf File opened for reading /proc/59cmdline d308611c459eb18bd3d7391f76beba1d.elf
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/740-1-0x00400000-0x00458ce0-memory.dmp