mirai | 7b70a361db32f477df25723fdda0dc1349235019cdb3738deaa1a5a80461bc64 | Triage

Analysis

max time kernel
2s
max time network
134s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
27-11-2024 08:42

Sharing

Report Analysis Logs

General

Target

dlr.arm6.elf
Size

48KB
MD5

5d58283e90264f69ff52fbcd52a3b178
SHA1

583d49cf615f7718873f27d58c6058c652a60c7d
SHA256

7b70a361db32f477df25723fdda0dc1349235019cdb3738deaa1a5a80461bc64
SHA512

9844662d31077cbc3f84903ff3c9cc527f99f63448251d6cf38d44bca8e4397d8d741be7dc69271591f22066a5d150e18ed7e16d2797606b449ba3a785423e11
SSDEEP

768:B0DdSs4rsssH9dhZ4zJivWvHmWrkiunSKwharbV0iKpWpt5UYaI:Bsdn4rs/rWeliunEarh0iaq5UYa

Score

10^/10

mirai lzrd botnet

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/byte	dlr.arm6.elf

/tmp/dlr.arm6.elf
/tmp/dlr.arm6.elf
1⤵
- Writes file to tmp directory
PID:704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/byte

Filesize
117KB

MD5
90dace050831597345679d7dfbd7d5b0

SHA1
6645cde5ce93d96a5e1e541770f14dc59100f364

SHA256
509a1343fab6dc704c0cb805284df2c7bd17194c487d250dfb9d6291561f981a

SHA512
71cae1e7c7ef3722d7fe325544898316c357fd81f063f867047586315b4170fe886302a672574e65fff937132f0afe233da0481b2da6fe36a14507e8c6212046

Download Submit