Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    27-07-2024 23:26

General

  • Target

    4762a76740b054e87fea2b4c96fb21d7.elf

  • Size

    49KB

  • MD5

    4762a76740b054e87fea2b4c96fb21d7

  • SHA1

    13e446ac976f9531f3a6010d243e729c438377ff

  • SHA256

    47561e093091d572a75257ed7021fd910d0c2046527c0b1ba3783b342f6809fa

  • SHA512

    e93473f156482d53219b8981403a2cfd4685c5b6dddd93140d0f769322c4bef0fc49272f3f184eb271f3f5ac3c0b2c599c2006593f9dfe9c976af2b06c8dd072

  • SSDEEP

    1536:lOE9hx1sNTAxARDB5xtFQ10kIWGoB72TzGTLIYM3nZq1ERu:lOlUKLtmNIWGo0TQMYM3nM1ERu

Score
10/10

Malware Config

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/4762a76740b054e87fea2b4c96fb21d7.elf
    /tmp/4762a76740b054e87fea2b4c96fb21d7.elf
    1⤵
    • Changes its process name
    • Reads runtime system information
    PID:638

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/638-1-0x00008000-0x00035b00-memory.dmp