Malware Analysis Report

2024-11-13 18:03

Sample ID 241109-epqm2axdml
Target fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf
SHA256 fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668
Tags
upx mirai lzrd botnet defense_evasion discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668

Threat Level: Known bad

The file fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf was found to be: Known bad.

Malicious Activity Summary

upx mirai lzrd botnet defense_evasion discovery

Mirai

Mirai family

Modifies Watchdog functionality

Enumerates running processes

Writes file to system bin folder

UPX packed file

Reads runtime system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 04:07

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 04:07

Reported

2024-11-09 04:09

Platform

debian9-armhf-20240611-en

Max time kernel

149s

Max time network

4s

Command Line

[/tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf]

Signatures

Mirai

botnet mirai

Mirai family

mirai

Modifies Watchdog functionality

defense_evasion
Description Indicator Process Target
File opened for modification /dev/watchdog /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for modification /dev/misc/watchdog /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A

Enumerates running processes

Writes file to system bin folder

Description Indicator Process Target
File opened for modification /bin/watchdog /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for modification /sbin/watchdog /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A

Reads runtime system information

discovery
Description Indicator Process Target
File opened for reading /proc/773/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/777/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/653/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/654/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/719/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/748/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/604/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/787/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/791/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/590/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/781/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/655/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/687/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/723/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/783/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/self/exe /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/670/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/789/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/610/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/659/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/775/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/779/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/766/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/768/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/785/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/608/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/611/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/648/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/731/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/747/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/765/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A
File opened for reading /proc/793/cmdline /tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf N/A

Processes

/tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf

[/tmp/fef5559fe3a9e12f46093d294db90d5feb10981f158ffa3569c7558629049668.elf]

Network

Country Destination Domain Proto
DE 147.45.42.138:3778 tcp

Files

memory/656-1-0x00008000-0x0001dca4-memory.dmp