Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
-
submitted
06-11-2024 13:57
General
-
Target
h0r0zx00x.x86.elf
-
Size
30KB
-
MD5
d8fb6401cc65babe5175807a3f63ff14
-
SHA1
9194baed313ee944ef92a86a4311d963b1e56728
-
SHA256
5a1257b3e863798fd601414bfe267e46db1b755eaa471818bd204c0b9efa6228
-
SHA512
12438a96710084995dea8a225f88c863f28687520b45e9f37a73b4f5af5c2577560b637b0f0be3ece24ba6a376557b8c1a1e26fe77314735ac17801a964b0320
-
SSDEEP
768:Dq3ydi2rg98FdmvPyQw7NAFkcEfdhpJJLTsiLetyS33UXn68FqK6:siFdmvPgA2cEfdhxLYiFvXnW9
Malware Config
Extracted
mirai
UNSTABLE
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Contacts a large (152889) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
-
Changes its process name 1 IoCs
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/h0r0zx00x.x86.elf/tmp/h0r0zx00x.x86.elf1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
- Reads runtime system information