Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240418-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    23/11/2024, 19:17 UTC

General

  • Target

    Satan.arm.elf

  • Size

    38KB

  • MD5

    c6a8c79e2ebbc90f4cf47f4810daadd3

  • SHA1

    093908067e7d575412aca9eb3f34c1ce4320715c

  • SHA256

    acef8177afcd54f929fc30ce23f884dc92855db67aa693392049082fc055047e

  • SHA512

    2c71a52a9a7968137143f4e9f404542a7aa6f107d431f186a442b1ab515222cce69c12bfdb5f4b0ab7252e1cf9880f73ae479d6e5f00699b11f653eaae73b949

  • SSDEEP

    768:2ufHR8HXrbu1pVi1lCIxeP7v4AAZPbfbW7eH+pFs3UozNW:BHSbbu1pVKC6ez4tdbf67bIzNW

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 2 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/Satan.arm.elf
    /tmp/Satan.arm.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Reads runtime system information
    PID:645

Network

    No results found
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
  • 193.84.71.119:3778
    60 B
    40 B
    1
    1
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.