mirai | 620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42

Analysis

max time kernel
149s
max time network
143s
platform
debian-12_armhf
resource
debian12-armhf-20240729-en
resource tags

arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
10-10-2024 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
Size

45KB
MD5

29e4434dd97eed956d3de4768dd6b8a0
SHA1

03a8fd9be3e487383bc14440cde37402db2fb7a7
SHA256

620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42
SHA512

89b0ade77da7f78fba7fb6fdc2f2be8c5219651afb3676d277c6e9726227983f6ddac55a15c3e38a5d05d9484424d360bb23289b2824b314f5e509004768aea4
SSDEEP

768:g/TYCoIxdEk+AxoTZAZHFeq8b3d9q3UELbUXfi6nVMQHI4vcGpv2:gECFd+A6YHAxwLRQZ2

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
File opened for modification	/dev/misc/watchdog	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
File opened for modification	/bin/watchdog	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/664/cmdline	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
File opened for reading	/proc/696/cmdline	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
File opened for reading	/proc/701/cmdline	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
File opened for reading	/proc/661/cmdline	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
File opened for reading	/proc/678/cmdline	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
File opened for reading	/proc/702/cmdline	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
File opened for reading	/proc/709/cmdline	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
File opened for reading	/proc/self/exe	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
File opened for reading	/proc/629/cmdline	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
File opened for reading	/proc/645/cmdline	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
File opened for reading	/proc/646/cmdline	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
File opened for reading	/proc/719/cmdline	620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf

/tmp/620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
/tmp/620dbd60a2a036f122bc6ece90ddfd8448fdf6b46ad9a1270a0b41266bce0b42.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:703

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/703-1-0x00008000-0x00026464-memory.dmp

Download