mirai | ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01

General

Target

ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
Size

43KB
MD5

83670883bf6c23fde31e26ace4f1f600
SHA1

f96e64a1f3db3b0d61828d50b134fa8ccbe4047d
SHA256

ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01
SHA512

585ce15f4f503ed044f42af00d70039bd09b8ed90b68fd293e230a2652a10c7ce56d153535bdb47105ee87629c56deddcb0bda66ace03f6af815a137c1057115
SSDEEP

768:4QdzLFMbXkqyyxwmGFm3qsSPhkj96MiKrecs6cDtyO5XnQDlIPyWZ:nPmwqBOc31LNrecs6KtPXQDSh

Score

10^/10

mirai botnet defense_evasion discovery

Malware Config

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

Processes:

ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf

description	ioc	process
File opened for modification	/dev/watchdog	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for modification	/dev/misc/watchdog	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

Processes:

ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf

description	ioc	process
File opened for modification	/sbin/watchdog	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for modification	/bin/watchdog	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf

description	ioc	process
File opened for reading	/proc/27/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/382/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/667/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/711/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/8/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/19/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/24/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/371/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/7/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/34/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/114/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/744/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/2/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/9/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/29/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/30/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/33/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/392/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/710/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/745/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/17/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/22/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/1/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/137/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/3/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/12/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/14/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/16/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/37/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/112/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/116/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/262/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/353/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/733/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/4/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/5/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/115/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/419/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/722/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/18/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/28/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/48/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/113/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/697/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/738/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/32/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/35/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/138/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/388/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/749/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/13/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/15/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/359/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/680/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/713/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/6/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/11/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/44/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/119/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/363/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/699/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/20/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/42/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/53/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf

/tmp/ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
/tmp/ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:745

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/745-1-0x00400000-0x0043affc-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads