Analysis
- max time kernel
150s - max time network
157s - platform
debian-12_armhf - resource
debian12-armhf-20240221-en - resource tags
- submitted
10/08/2024, 01:40
General
- Target beaeb0bc06826cd38c5ca522365dad1a9463defdd9767aa8c04edf464ae38fd0.elf
- Size 52KB
- Sample240810-b322fatfpd
- SHA256 beaeb0bc06826cd38c5ca522365dad1a9463defdd9767aa8c04edf464ae38fd0
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
Signatures
- Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
- Contacts a large (20716) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Reads runtime system information 13 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/beaeb0bc06826cd38c5ca522365dad1a9463defdd9767aa8c04edf464ae38fd0.elf/tmp/beaeb0bc06826cd38c5ca522365dad1a9463defdd9767aa8c04edf464ae38fd0.elf1⤵
- Modifies Watchdog functionality
- Reads runtime system information