Analysis

  • max time kernel
    135s
  • max time network
    147s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240729-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    14/10/2024, 02:07

General

  • Target

    ec1b4bd25c941959d242b33e9ea0948b98c4a1b34d1e17590604ab36a9bfdda8.elf

  • Size

    38KB

  • MD5

    a460bd5739f2ed553acdbb22a85b813d

  • SHA1

    54fb2f10e46941231021b954322848cc221de87b

  • SHA256

    ec1b4bd25c941959d242b33e9ea0948b98c4a1b34d1e17590604ab36a9bfdda8

  • SHA512

    16b1103e96afd2a6f24c4bcadcb0f9967eab6bc9fdf9d88d0a172e853535a47505db7cac3d3bf5150bea843326ed6b76422d412764d7ad8bc9aa9179adc9e377

  • SSDEEP

    768:Hu7RATMUu4f7RDdP6NM8I52VNbvdFsDJ4pBTps3UozOs:ARAC4fNDdP6N5pd+DyT0zOs

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 2 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/ec1b4bd25c941959d242b33e9ea0948b98c4a1b34d1e17590604ab36a9bfdda8.elf
    /tmp/ec1b4bd25c941959d242b33e9ea0948b98c4a1b34d1e17590604ab36a9bfdda8.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Reads runtime system information
    PID:655

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads