mirai | ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01

General

Target

ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
Size

43KB
MD5

83670883bf6c23fde31e26ace4f1f600
SHA1

f96e64a1f3db3b0d61828d50b134fa8ccbe4047d
SHA256

ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01
SHA512

585ce15f4f503ed044f42af00d70039bd09b8ed90b68fd293e230a2652a10c7ce56d153535bdb47105ee87629c56deddcb0bda66ace03f6af815a137c1057115
SSDEEP

768:4QdzLFMbXkqyyxwmGFm3qsSPhkj96MiKrecs6cDtyO5XnQDlIPyWZ:nPmwqBOc31LNrecs6KtPXQDSh

Score

10^/10

mirai botnet defense_evasion discovery

Malware Config

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

Processes:

ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf

description	ioc	process
File opened for modification	/dev/misc/watchdog	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for modification	/dev/watchdog	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

Processes:

ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf

description	ioc	process
File opened for modification	/sbin/watchdog	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for modification	/bin/watchdog	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf

description	ioc	process
File opened for reading	/proc/7/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/17/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/374/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/69/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/688/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/689/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/697/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/3/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/13/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/105/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/166/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/22/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/24/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/142/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/323/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/330/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/693/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/533/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/696/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/701/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/6/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/78/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/115/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/390/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/486/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/14/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/72/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/79/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/1/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/16/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/19/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/37/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/76/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/376/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/532/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/9/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/20/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/326/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/491/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/674/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/691/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/73/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/334/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/11/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/12/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/239/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/70/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/71/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/82/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/694/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/2/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/5/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/149/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/386/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/695/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/15/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/36/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/74/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/116/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/4/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/18/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/21/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/8/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
File opened for reading	/proc/10/status	ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf

/tmp/ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
/tmp/ff4dc55c5ff519b6dd3e18ae7ed93d7b44699174b12d4501bfbfac17cf65ea01.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/696-1-0x00400000-0x0043affc-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads