mirai | 5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b

Analysis

max time kernel
137s
max time network
153s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
20-11-2024 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Satan.mips.elf
Size

43KB
MD5

0f9243f3bb330ae152066d721cae99c9
SHA1

7757b9813ca2ae175aa4be68a194b059159688e3
SHA256

5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b
SHA512

3e858e572abc6d2d0dd79da888f470fcb334e3a200e18e0b766056662890b0f0371185f82f9b89c2a505db905ad7d836d0353c54f8e3aef8028ffcf5cb7c20f1
SSDEEP

768:M6DfzzMwdu3W4CbuznqQd8eYkGyJfH6QhjS0jlDGnHMhgNSRxUkCkHhVeg5277Ht:tDEwdu3ubuznqreGyJfH6QhjDGnHMhgb

Score

10^/10

mirai botnet defense_evasion discovery

Malware Config

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
defense_evasion

Impair Defenses
T1562

Processes:

Satan.mips.elf

description ioc process

File opened for modification /dev/watchdog Satan.mips.elf
File opened for modification /dev/misc/watchdog Satan.mips.elf
Enumerates running processes
Discovers information about currently running processes on the system
Writes file to system bin folder 2 IoCs

Processes:

Satan.mips.elf

description ioc process

File opened for modification /sbin/watchdog Satan.mips.elf
File opened for modification /bin/watchdog Satan.mips.elf

description	ioc	process
File opened for modification	/dev/watchdog	Satan.mips.elf
File opened for modification	/dev/misc/watchdog	Satan.mips.elf

description	ioc	process
File opened for modification	/sbin/watchdog	Satan.mips.elf
File opened for modification	/bin/watchdog	Satan.mips.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

Satan.mips.elf

description	ioc	process
File opened for reading	/proc/697/status	Satan.mips.elf
File opened for reading	/proc/11/status	Satan.mips.elf
File opened for reading	/proc/19/status	Satan.mips.elf
File opened for reading	/proc/20/status	Satan.mips.elf
File opened for reading	/proc/696/status	Satan.mips.elf
File opened for reading	/proc/69/status	Satan.mips.elf
File opened for reading	/proc/322/status	Satan.mips.elf
File opened for reading	/proc/4/status	Satan.mips.elf
File opened for reading	/proc/15/status	Satan.mips.elf
File opened for reading	/proc/103/status	Satan.mips.elf
File opened for reading	/proc/387/status	Satan.mips.elf
File opened for reading	/proc/690/status	Satan.mips.elf
File opened for reading	/proc/8/status	Satan.mips.elf
File opened for reading	/proc/76/status	Satan.mips.elf
File opened for reading	/proc/142/status	Satan.mips.elf
File opened for reading	/proc/479/status	Satan.mips.elf
File opened for reading	/proc/703/status	Satan.mips.elf
File opened for reading	/proc/10/status	Satan.mips.elf
File opened for reading	/proc/166/status	Satan.mips.elf
File opened for reading	/proc/321/status	Satan.mips.elf
File opened for reading	/proc/700/status	Satan.mips.elf
File opened for reading	/proc/386/status	Satan.mips.elf
File opened for reading	/proc/676/status	Satan.mips.elf
File opened for reading	/proc/695/status	Satan.mips.elf
File opened for reading	/proc/21/status	Satan.mips.elf
File opened for reading	/proc/71/status	Satan.mips.elf
File opened for reading	/proc/81/status	Satan.mips.elf
File opened for reading	/proc/370/status	Satan.mips.elf
File opened for reading	/proc/150/status	Satan.mips.elf
File opened for reading	/proc/2/status	Satan.mips.elf
File opened for reading	/proc/72/status	Satan.mips.elf
File opened for reading	/proc/373/status	Satan.mips.elf
File opened for reading	/proc/74/status	Satan.mips.elf
File opened for reading	/proc/83/status	Satan.mips.elf
File opened for reading	/proc/114/status	Satan.mips.elf
File opened for reading	/proc/478/status	Satan.mips.elf
File opened for reading	/proc/23/status	Satan.mips.elf
File opened for reading	/proc/24/status	Satan.mips.elf
File opened for reading	/proc/36/status	Satan.mips.elf
File opened for reading	/proc/73/status	Satan.mips.elf
File opened for reading	/proc/691/status	Satan.mips.elf
File opened for reading	/proc/3/status	Satan.mips.elf
File opened for reading	/proc/6/status	Satan.mips.elf
File opened for reading	/proc/12/status	Satan.mips.elf
File opened for reading	/proc/18/status	Satan.mips.elf
File opened for reading	/proc/9/status	Satan.mips.elf
File opened for reading	/proc/113/status	Satan.mips.elf
File opened for reading	/proc/16/status	Satan.mips.elf
File opened for reading	/proc/17/status	Satan.mips.elf
File opened for reading	/proc/450/status	Satan.mips.elf
File opened for reading	/proc/318/status	Satan.mips.elf
File opened for reading	/proc/5/status	Satan.mips.elf
File opened for reading	/proc/70/status	Satan.mips.elf
File opened for reading	/proc/77/status	Satan.mips.elf
File opened for reading	/proc/315/status	Satan.mips.elf
File opened for reading	/proc/22/status	Satan.mips.elf
File opened for reading	/proc/78/status	Satan.mips.elf
File opened for reading	/proc/316/status	Satan.mips.elf
File opened for reading	/proc/455/status	Satan.mips.elf
File opened for reading	/proc/7/status	Satan.mips.elf
File opened for reading	/proc/37/status	Satan.mips.elf
File opened for reading	/proc/223/status	Satan.mips.elf
File opened for reading	/proc/1/status	Satan.mips.elf
File opened for reading	/proc/13/status	Satan.mips.elf

System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
discovery

System Network Configuration Discovery
T1016

Processes:

Satan.mips.elf

pid process

699 Satan.mips.elf

pid	process
699	Satan.mips.elf

/tmp/Satan.mips.elf
/tmp/Satan.mips.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
- System Network Configuration Discovery
PID:699

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/699-1-0x00400000-0x0043cffc-memory.dmp

Download