Analysis

  • max time kernel
    135s
  • max time network
    146s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    09-11-2024 03:48

General

  • Target

    de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf

  • Size

    35KB

  • MD5

    4c64afb0ad73da68d0e9dc8894d97f3a

  • SHA1

    0d3f5938508079bf9dbbe13d75d7b91e21845312

  • SHA256

    de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b

  • SHA512

    7e65132191ca5f83ac7ce6b7d63a3423175d3ab893a859c1de37fd9d22f4fd4c76cfc163405ddc6c6c2910c31831a3c0a4f3b86fa68a241c40f328823050e107

  • SSDEEP

    768:PW/zEpEYEgHE+Tc70R1cVC9owNnTAz9okfh+/cnbcuyD7UHQRj6:u4B1E+TcAYC9owui7Enouy8Hy+

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 2 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf
    /tmp/de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Reads runtime system information
    PID:1565

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1565-1-0x0000000008048000-0x000000000805cc40-memory.dmp