mirai | 92e42f10b866c7518523cdbea1160b773d52c0594b82057d20b8d9e8e1a784bd

Analysis

max time kernel
151s
max time network
154s
platform
debian-12_mipsel
resource
debian12-mipsel-20240221-en
resource tags

arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
19-09-2024 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
Size

24KB
MD5

eac4091aa1562432e55b2b64f8cd8bed
SHA1

ee84178a44dd54da0d1ef49d83faf2b9cc865a35
SHA256

92e42f10b866c7518523cdbea1160b773d52c0594b82057d20b8d9e8e1a784bd
SHA512

f5baa1dad8159b25d2cbe9fa7dcc9f7de38a4ecf0e8416cff8accbf905d84cf94e520619551408e74e4710f6a4d716394cb68648d4b0659c87c5f6b6e0ec41ac
SSDEEP

384:j4ZFcgAasNX4oLGx9kz+KgnlU8QAtwGFv/Y+z238xdticulcibfq3xh1l9v2ox2h:jTg/KWlfrth/HtdRulcibibvEPp

Score

10^/10

mirai botnet credential_access defense_evasion discovery

Malware Config

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (145964) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
File opened for modification	/dev/misc/watchdog	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118

Reads process memory 1 TTPs 15 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/415/maps	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
File opened for reading	/proc/680/maps	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
File opened for reading	/proc/721/maps	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
File opened for reading	/proc/743/maps	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
File opened for reading	/proc/750/maps	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
File opened for reading	/proc/681/maps	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
File opened for reading	/proc/698/maps	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
File opened for reading	/proc/711/maps	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
File opened for reading	/proc/718/maps	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
File opened for reading	/proc/742/maps	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
File opened for reading	/proc/668/maps	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
File opened for reading	/proc/699/maps	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
File opened for reading	/proc/732/maps	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
File opened for reading	/proc/733/maps	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
File opened for reading	/proc/745/maps	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	["kpthread"]	739	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118

/tmp/eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
/tmp/eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads process memory
- Changes its process name
- Reads system network configuration
PID:739

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads