Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240729-en -
resource tags
-
submitted
02-09-2024 04:34
General
-
Target
mirai.mpsl.elf
-
Size
118KB
-
MD5
3022d8d617de493e53d40cf02ff12aac
-
SHA1
024784163955d70de27ade20b60a648dd4be9264
-
SHA256
c4ca35db2a19f880b40867e814250a55d27b1621c39160ffc436e6653c06f976
-
SHA512
73f4a9ffc0b28cc1c4aedfec3d4c9b09d6171a848b32c6eabedf60f953ff6acedb6d9dcf3517ec5d5864755eeaaa6d7729b2559ea776b025c2b317d9db0db51c
-
SSDEEP
1536:zxPRAmySO4TJNXIav45fSvJyRIDuGnMa9toHbDrOjP8El:zx8SfTJNXIw4VSvJ/Mwom
Malware Config
Signatures
-
Contacts a large (23994) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 29 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/mirai.mpsl.elf/tmp/mirai.mpsl.elf1⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information