mirai | cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934

Analysis

max time kernel
135s
max time network
182s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20-11-2024 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Satan.arm7.elf
Size

60KB
MD5

da97620c8413c5ee36534de7c981ef89
SHA1

6d92fc519ae01744c14321ae66edd3f930da1298
SHA256

cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934
SHA512

e024affe5b3065f94989f092160fb07cd27dccb08dde17d31ee0bc6326484dd14044f9aac848db2a2074a9b595bbd0a673d547e18015af9d5962224f2667de3a
SSDEEP

1536:zVQSmwtMJXmejtHLVOBCLTM5Tfv83KJ2crl2EWT:zVywt8XZ5LYBCLgTX83KHl2EWT

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
defense_evasion

Impair Defenses
T1562

Processes:

Satan.arm7.elf

description ioc process

File opened for modification /dev/watchdog Satan.arm7.elf
File opened for modification /dev/misc/watchdog Satan.arm7.elf
Enumerates running processes
Discovers information about currently running processes on the system
Writes file to system bin folder 2 IoCs

Processes:

Satan.arm7.elf

description ioc process

File opened for modification /sbin/watchdog Satan.arm7.elf
File opened for modification /bin/watchdog Satan.arm7.elf

description	ioc	process
File opened for modification	/dev/watchdog	Satan.arm7.elf
File opened for modification	/dev/misc/watchdog	Satan.arm7.elf

description	ioc	process
File opened for modification	/sbin/watchdog	Satan.arm7.elf
File opened for modification	/bin/watchdog	Satan.arm7.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

Satan.arm7.elf

description	ioc	process
File opened for reading	/proc/6/status	Satan.arm7.elf
File opened for reading	/proc/15/status	Satan.arm7.elf
File opened for reading	/proc/588/status	Satan.arm7.elf
File opened for reading	/proc/659/status	Satan.arm7.elf
File opened for reading	/proc/1/status	Satan.arm7.elf
File opened for reading	/proc/150/status	Satan.arm7.elf
File opened for reading	/proc/661/status	Satan.arm7.elf
File opened for reading	/proc/16/status	Satan.arm7.elf
File opened for reading	/proc/102/status	Satan.arm7.elf
File opened for reading	/proc/268/status	Satan.arm7.elf
File opened for reading	/proc/332/status	Satan.arm7.elf
File opened for reading	/proc/608/status	Satan.arm7.elf
File opened for reading	/proc/20/status	Satan.arm7.elf
File opened for reading	/proc/28/status	Satan.arm7.elf
File opened for reading	/proc/660/status	Satan.arm7.elf
File opened for reading	/proc/43/status	Satan.arm7.elf
File opened for reading	/proc/173/status	Satan.arm7.elf
File opened for reading	/proc/314/status	Satan.arm7.elf
File opened for reading	/proc/2/status	Satan.arm7.elf
File opened for reading	/proc/4/status	Satan.arm7.elf
File opened for reading	/proc/14/status	Satan.arm7.elf
File opened for reading	/proc/312/status	Satan.arm7.elf
File opened for reading	/proc/325/status	Satan.arm7.elf
File opened for reading	/proc/3/status	Satan.arm7.elf
File opened for reading	/proc/10/status	Satan.arm7.elf
File opened for reading	/proc/25/status	Satan.arm7.elf
File opened for reading	/proc/113/status	Satan.arm7.elf
File opened for reading	/proc/139/status	Satan.arm7.elf
File opened for reading	/proc/665/status	Satan.arm7.elf
File opened for reading	/proc/7/status	Satan.arm7.elf
File opened for reading	/proc/41/status	Satan.arm7.elf
File opened for reading	/proc/144/status	Satan.arm7.elf
File opened for reading	/proc/648/status	Satan.arm7.elf
File opened for reading	/proc/662/status	Satan.arm7.elf
File opened for reading	/proc/9/status	Satan.arm7.elf
File opened for reading	/proc/17/status	Satan.arm7.elf
File opened for reading	/proc/22/status	Satan.arm7.elf
File opened for reading	/proc/23/status	Satan.arm7.elf
File opened for reading	/proc/654/status	Satan.arm7.elf
File opened for reading	/proc/655/status	Satan.arm7.elf
File opened for reading	/proc/12/status	Satan.arm7.elf
File opened for reading	/proc/80/status	Satan.arm7.elf
File opened for reading	/proc/112/status	Satan.arm7.elf
File opened for reading	/proc/279/status	Satan.arm7.elf
File opened for reading	/proc/8/status	Satan.arm7.elf
File opened for reading	/proc/18/status	Satan.arm7.elf
File opened for reading	/proc/19/status	Satan.arm7.elf
File opened for reading	/proc/155/status	Satan.arm7.elf
File opened for reading	/proc/156/status	Satan.arm7.elf
File opened for reading	/proc/215/status	Satan.arm7.elf
File opened for reading	/proc/self/exe	Satan.arm7.elf
File opened for reading	/proc/26/status	Satan.arm7.elf
File opened for reading	/proc/42/status	Satan.arm7.elf
File opened for reading	/proc/110/status	Satan.arm7.elf
File opened for reading	/proc/11/status	Satan.arm7.elf
File opened for reading	/proc/21/status	Satan.arm7.elf
File opened for reading	/proc/159/status	Satan.arm7.elf
File opened for reading	/proc/5/status	Satan.arm7.elf
File opened for reading	/proc/13/status	Satan.arm7.elf
File opened for reading	/proc/29/status	Satan.arm7.elf
File opened for reading	/proc/275/status	Satan.arm7.elf
File opened for reading	/proc/276/status	Satan.arm7.elf
File opened for reading	/proc/657/status	Satan.arm7.elf
File opened for reading	/proc/24/status	Satan.arm7.elf

/tmp/Satan.arm7.elf
/tmp/Satan.arm7.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:662

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/662-1-0x00008000-0x000236c8-memory.dmp

Download