mirai | c792ce87ba1b0dc37cf3d2d2b4ad3433395ae93e0f1ae9c1140d097d093c1457

Analysis

max time kernel
148s
max time network
151s
platform
debian-12_armhf
resource
debian12-armhf-20240729-en
resource tags

arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
09-10-2024 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c792ce87ba1b0dc37cf3d2d2b4ad3433395ae93e0f1ae9c1140d097d093c1457.elf
Size

61KB
MD5

7ff7cdd806adaea6085384f85a736106
SHA1

07f7ee2a8c37722956faa1fe024b57b63732f808
SHA256

c792ce87ba1b0dc37cf3d2d2b4ad3433395ae93e0f1ae9c1140d097d093c1457
SHA512

53f9a53947254532b93f13241f3edef41f8d9b5fa76bd01a18eeb458d3c3ca1cdc93265aaaf638eaeb02d2f52685035fa3b4a60c1555d48f55d1f6493ce43e1d
SSDEEP

768:p5lDNDz4z9We1VkLfHRzdGUelY4encoEWhowytRUE0OUkFtHyxEbuUGRrJeI7ySM:pNDzcj1VCRMde/NGdPBbqMLRAKJUGua

Score

10^/10

mirai botnet defense_evasion discovery

Malware Config

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Deletes itself 1 IoCs

pid	Process
704	c792ce87ba1b0dc37cf3d2d2b4ad3433395ae93e0f1ae9c1140d097d093c1457.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	c792ce87ba1b0dc37cf3d2d2b4ad3433395ae93e0f1ae9c1140d097d093c1457.elf
File opened for modification	/dev/misc/watchdog	c792ce87ba1b0dc37cf3d2d2b4ad3433395ae93e0f1ae9c1140d097d093c1457.elf

Traces itself 1 IoCs

Traces itself to prevent debugging attempts

pid	Process
704	c792ce87ba1b0dc37cf3d2d2b4ad3433395ae93e0f1ae9c1140d097d093c1457.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	c792ce87ba1b0dc37cf3d2d2b4ad3433395ae93e0f1ae9c1140d097d093c1457.elf
File opened for modification	/bin/watchdog	c792ce87ba1b0dc37cf3d2d2b4ad3433395ae93e0f1ae9c1140d097d093c1457.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/var/ftper	704	c792ce87ba1b0dc37cf3d2d2b4ad3433395ae93e0f1ae9c1140d097d093c1457.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/323/environ	ps
File opened for reading	/proc/21/environ	ps
File opened for reading	/proc/776/stat	ps
File opened for reading	/proc/42/cmdline	ps
File opened for reading	/proc/902/cmdline	ps
File opened for reading	/proc/362/status	ps
File opened for reading	/proc/10/environ	ps
File opened for reading	/proc/706/environ	ps
File opened for reading	/proc/73/stat	ps
File opened for reading	/proc/33/stat	ps
File opened for reading	/proc/51/cmdline	ps
File opened for reading	/proc/5/environ	ps
File opened for reading	/proc/3/environ	ps
File opened for reading	/proc/73/cmdline	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/73/status	ps
File opened for reading	/proc/835/cmdline	ps
File opened for reading	/proc/15/environ	ps
File opened for reading	/proc/706/environ	ps
File opened for reading	/proc/46/status	ps
File opened for reading	/proc/36/cmdline	ps
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/142/environ	ps
File opened for reading	/proc/27/status	ps
File opened for reading	/proc/51/status	ps
File opened for reading	/proc/697/stat	ps
File opened for reading	/proc/143/stat	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/143/cmdline	ps
File opened for reading	/proc/706/stat	ps
File opened for reading	/proc/23/cmdline	ps
File opened for reading	/proc/46/status	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/362/status	ps
File opened for reading	/proc/769/stat	ps
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/2/status	ps
File opened for reading	/proc/9/stat	ps
File opened for reading	/proc/831/status	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/709/status	ps
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/769/environ	ps
File opened for reading	/proc/829/status	ps
File opened for reading	/proc/5/cmdline	ps
File opened for reading	/proc/8/cmdline	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/775/cmdline	ps
File opened for reading	/proc/31/status	ps
File opened for reading	/proc/143/status	ps
File opened for reading	/proc/831/status	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/13/cmdline	ps
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/829/stat	ps
File opened for reading	/proc/4/stat	ps
File opened for reading	/proc/35/status	ps
File opened for reading	/proc/270/cmdline	ps

/tmp/c792ce87ba1b0dc37cf3d2d2b4ad3433395ae93e0f1ae9c1140d097d093c1457.elf
/tmp/c792ce87ba1b0dc37cf3d2d2b4ad3433395ae93e0f1ae9c1140d097d093c1457.elf
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Traces itself
- Writes file to system bin folder
- Changes its process name
PID:704
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:756
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:757
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:817
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:818
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:835
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:836
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:837
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    PID:838
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:839
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:840
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:841
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:842
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:843
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    PID:844
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:845
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    PID:846
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:847
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:848
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:849
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    PID:850
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:851
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:852
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:853
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    PID:854
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:855
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:856
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:857
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:858
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:859
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    PID:860
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:861
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:862
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:863
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:864
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:865
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:866
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:867
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:868
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:869
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:870
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:871
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:872
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:873
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:874
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:875
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:876
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:877
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:878
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:879
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:880
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:881
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    PID:882
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:883
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:884
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:885
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:886
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:887
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:888
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:889
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:890
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:891
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:892
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:893
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:894
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:895
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    PID:896
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:897
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:898
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:899
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:900
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:901
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:902
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:903
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:904
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:905
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:906
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:907
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    PID:908
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:909
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:910
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:911
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:912
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:913
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:914
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:915
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:916
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:917
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:918
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:919
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:920
- /bin/sh
  sh -c "ps -A -o pid,cmd --no-headers"
  2⤵
  PID:921
- - /usr/bin/ps
    ps -A -o "pid,cmd" --no-headers
    3⤵
    - Reads runtime system information
    PID:922

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/704-1-0x00008000-0x0002c3e0-memory.dmp

Download