Malware Analysis Report

2024-12-07 17:31

Sample ID 241112-c95lkswmbj
Target a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf
SHA256 a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b
Tags
credential_access defense_evasion mirai
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b

Threat Level: Known bad

The file a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf was found to be: Known bad.

Malicious Activity Summary

credential_access defense_evasion mirai

Mirai family

Modifies Watchdog functionality

Reads process memory

Changes its process name

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 02:47

Signatures

Mirai family

mirai

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 02:47

Reported

2024-11-12 02:50

Platform

debian12-mipsel-20240221-en

Max time kernel

152s

Max time network

159s

Command Line

[/tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf]

Signatures

Modifies Watchdog functionality

defense_evasion
Description Indicator Process Target
File opened for modification /dev/watchdog /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for modification /dev/misc/watchdog /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A

Reads process memory

credential_access
Description Indicator Process Target
File opened for reading /proc/655/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/690/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/704/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/732/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/756/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/412/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/692/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/744/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/414/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/688/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/714/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/717/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/721/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/775/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/776/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/430/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/642/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/711/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/733/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/746/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/750/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A
File opened for reading /proc/774/maps /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A

Changes its process name

Description Indicator Process Target
Changes the process name, possibly in an attempt to hide itself a /tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf N/A

Processes

/tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf

[/tmp/a82110cbe11fd10f36d9d33a95596715d0a91a203eaf37d7e971df060dc73f4b.elf]

Network

Country Destination Domain Proto
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 8.8.8.8:53 193.84.71.119 udp
US 193.84.71.119:38241 tcp
US 1.1.1.1:53 debian12-mipsel-20240221-en-2 udp
US 1.1.1.1:53 debian12-mipsel-20240221-en-2 udp
US 1.1.1.1:53 debian12-mipsel-20240221-en-2 udp
US 1.1.1.1:53 debian12-mipsel-20240221-en-2 udp

Files

N/A