mirai | 5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b

General

Target

5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
Size

43KB
MD5

0f9243f3bb330ae152066d721cae99c9
SHA1

7757b9813ca2ae175aa4be68a194b059159688e3
SHA256

5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b
SHA512

3e858e572abc6d2d0dd79da888f470fcb334e3a200e18e0b766056662890b0f0371185f82f9b89c2a505db905ad7d836d0353c54f8e3aef8028ffcf5cb7c20f1
SSDEEP

768:M6DfzzMwdu3W4CbuznqQd8eYkGyJfH6QhjS0jlDGnHMhgNSRxUkCkHhVeg5277Ht:tDEwdu3ubuznqreGyJfH6QhjDGnHMhgb

Score

10^/10

mirai botnet defense_evasion discovery

Malware Config

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

Processes:

5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf

description	ioc	process
File opened for modification	/dev/watchdog	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for modification	/dev/misc/watchdog	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

Processes:

5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf

description	ioc	process
File opened for modification	/sbin/watchdog	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for modification	/bin/watchdog	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf

description	ioc	process
File opened for reading	/proc/729/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/75/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/157/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/356/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/358/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/676/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/389/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/3/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/22/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/23/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/76/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/122/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/12/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/17/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/359/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/21/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/37/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/80/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/453/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/682/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/9/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/36/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/77/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/153/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/720/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/217/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/361/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/1/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/16/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/19/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/73/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/78/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/335/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/386/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/395/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/2/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/20/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/72/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/74/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/174/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/679/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/724/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/4/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/18/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/71/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/717/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/703/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/8/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/10/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/81/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/248/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/681/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/5/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/726/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/13/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/14/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/70/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/110/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/718/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/6/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/725/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/11/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/24/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
File opened for reading	/proc/722/status	5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf

/tmp/5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
/tmp/5d98715cda4a5de8bea0830b8b7dc2823820b1e374b783e314c2ee8c539b262b.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:725

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/725-1-0x00400000-0x0043cffc-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads