mirai | cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934

General

Target

cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
Size

60KB
MD5

da97620c8413c5ee36534de7c981ef89
SHA1

6d92fc519ae01744c14321ae66edd3f930da1298
SHA256

cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934
SHA512

e024affe5b3065f94989f092160fb07cd27dccb08dde17d31ee0bc6326484dd14044f9aac848db2a2074a9b595bbd0a673d547e18015af9d5962224f2667de3a
SSDEEP

1536:zVQSmwtMJXmejtHLVOBCLTM5Tfv83KJ2crl2EWT:zVywt8XZ5LYBCLgTX83KHl2EWT

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

Processes:

cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf

description	ioc	process
File opened for modification	/dev/watchdog	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for modification	/dev/misc/watchdog	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

Processes:

cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf

description	ioc	process
File opened for modification	/sbin/watchdog	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for modification	/bin/watchdog	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf

description	ioc	process
File opened for reading	/proc/269/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/638/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/self/exe	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/76/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/109/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/586/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/648/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/6/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/14/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/640/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/299/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/309/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/1/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/163/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/270/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/29/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/631/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/7/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/13/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/24/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/28/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/42/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/8/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/10/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/11/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/41/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/644/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/43/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/137/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/587/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/268/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/581/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/642/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/645/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/2/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/5/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/26/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/3/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/12/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/143/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/4/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/106/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/108/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/18/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/21/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/27/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/22/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/25/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/278/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/298/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/321/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/16/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/19/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/20/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/598/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/637/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/643/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/23/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/147/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/219/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/277/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/584/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/15/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
File opened for reading	/proc/98/status	cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf

/tmp/cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
/tmp/cb682ce20d0afc274cd99b9887059f1c6a548c29ddae763bf8785adb9fb8c934.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:645

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/645-1-0x00008000-0x000236c8-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads