mirai | a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2

Analysis

max time kernel
150s
max time network
133s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
01-11-2024 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
Size

45KB
MD5

cd00c303fc849a69496786762e151761
SHA1

2ff8ace1f63d5fdf932b0a940c5b688720258bdf
SHA256

a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2
SHA512

bc52dd144fe68086b953e87d4bd8404afd6f19af8398a23a74279c1efa44e6d6df5ca72c12fbda976b7ec4ca4f4e14d03461603516ba7d261af2e113547e0005
SSDEEP

768:K1fAdD6wdI2RuFbrUin4B/A7x6ixCNQ+adn9q3UELUNvu2M8CEv8JB505qmwL3X:K1SDHu94B0dgCtd2Levu2M9Dn5s7wL3X

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

Processes:

a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf

description	ioc	process
File opened for modification	/dev/watchdog	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for modification	/dev/misc/watchdog	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf

Writes file to system bin folder 2 IoCs

Processes:

a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf

description	ioc	process
File opened for modification	/sbin/watchdog	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for modification	/bin/watchdog	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf

Reads runtime system information 22 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf

description	ioc	process
File opened for reading	/proc/323/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/326/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/344/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/355/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/461/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/713/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/342/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/458/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/701/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/706/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/self/exe	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/310/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/318/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/341/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/614/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/619/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/316/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/665/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/683/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/707/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/714/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
File opened for reading	/proc/762/cmdline	a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf

/tmp/a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
/tmp/a75548ce5edcbeea32501578ae5b36c9ab7025793640d7867b2c7d193db4a3a2.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/708-1-0x00008000-0x000263dc-memory.dmp

Download