Malware Analysis Report

2024-11-13 18:03

Sample ID 241109-en2c5swpft
Target fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf
SHA256 fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c
Tags
mirai lzrd botnet defense_evasion discovery upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c

Threat Level: Known bad

The file fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf was found to be: Known bad.

Malicious Activity Summary

mirai lzrd botnet defense_evasion discovery upx

Mirai

Mirai family

Modifies Watchdog functionality

Enumerates running processes

Writes file to system bin folder

UPX packed file

Reads runtime system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 04:05

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 04:05

Reported

2024-11-09 04:09

Platform

debian9-armhf-20240611-en

Max time kernel

148s

Max time network

34s

Command Line

[/tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf]

Signatures

Mirai

botnet mirai

Mirai family

mirai

Modifies Watchdog functionality

defense_evasion
Description Indicator Process Target
File opened for modification /dev/watchdog /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for modification /dev/misc/watchdog /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A

Enumerates running processes

Writes file to system bin folder

Description Indicator Process Target
File opened for modification /bin/watchdog /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for modification /sbin/watchdog /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A

Reads runtime system information

discovery
Description Indicator Process Target
File opened for reading /proc/585/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/588/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/721/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/767/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/717/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/759/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/763/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/765/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/753/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/775/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/self/exe /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/683/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/737/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/751/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/645/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/709/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/758/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/777/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/641/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/705/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/769/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/771/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/591/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/634/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/639/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/640/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/773/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/570/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/764/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/779/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/590/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/649/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A
File opened for reading /proc/761/cmdline /tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf N/A

Processes

/tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf

[/tmp/fc4933008b0b05d319c768deb7d3e21cc2a563285c57b4677a5b5fc740f29f1c.elf]

Network

Country Destination Domain Proto
DE 147.45.42.138:3778 tcp

Files

memory/642-1-0x00008000-0x00026464-memory.dmp