mirai | e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15

General

Target

e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
Size

30KB
MD5

94c8ad02aad22b8b625ae6340d53e69e
SHA1

dcc67be65528b750032840c11ed70bf18741e418
SHA256

e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15
SHA512

4830b0efad4cb5f713106caf0203b70ae7e0f863c5738d17cc3681f973ea152bb71de97dc0801f213ae95958e46640c7d2f2ec9b2f4bbb3923f9a7ceb7e876bf
SSDEEP

768:KlfoA3KYJ7OW3qOsTo2oVYQYOJgGlzDpbuR1Jl:G3N7OFOr2o1VJuj

Score

10^/10

mirai lzrd botnet discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (19983) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf

description	ioc	process
File opened for modification	/dev/watchdog	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for modification	/dev/misc/watchdog	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf

description ioc process

File opened for reading /proc/net/tcp e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
Enumerates running processes
Discovers information about currently running processes on the system
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf

description ioc process

File opened for reading /proc/net/tcp e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf

description	ioc	process
File opened for reading	/proc/net/tcp	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf

description	ioc	process
File opened for reading	/proc/net/tcp	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf

Reads runtime system information 50 IoCs

Reads data from /proc virtual filesystem.

Processes:

e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf

description	ioc	process
File opened for reading	/proc/714/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/465/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/820/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/349/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/702/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/727/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/776/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/1/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/323/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/493/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/502/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/798/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/697/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/457/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/165/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/709/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/697/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/792/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/808/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/325/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/696/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/703/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/711/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/701/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/714/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/322/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/457/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/696/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/740/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/706/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/769/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/709/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/502/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/229/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/350/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/385/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/465/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/781/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/374/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/682/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/370/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/682/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/716/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/389/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/788/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/821/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/145/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/708/fd	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/493/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
File opened for reading	/proc/780/exe	e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf

/tmp/e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
/tmp/e3c658517d4c7d370d79b71607fc878a359c93d44f4876abdcf1358f885ffb15.elf
1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:705