mirai | 0c37cfbe0b95bc0a4dbb2ba01a377e2a3a34182300d43b1af583790b944a4566

Analysis

max time kernel
149s
max time network
133s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
01/12/2024, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boatnet.arm7.elf
Size

45KB
MD5

81957eaea2be9a29f5ed8d95e17bc7c9
SHA1

57f102c4412c7b18c5350bdc0e432b63ec9db0db
SHA256

0c37cfbe0b95bc0a4dbb2ba01a377e2a3a34182300d43b1af583790b944a4566
SHA512

3a07c650ceabd7654e3895ef04ea3c1e784d91cd4bd4f98558ecb5f5f0f0767ee70544fde93490896d8c27ed9f7e8b62fc3ae0e06a7194aa7d5b4d5b2df1bb98
SSDEEP

768:g/TYCoIxdEk+AxoTZAZHFeq8b31W9q3UELbUXfi6nVMQHI4vcGpvd:gECFd+A6YHAxZLRQZd

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	boatnet.arm7.elf
File opened for modification	/dev/misc/watchdog	boatnet.arm7.elf

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	boatnet.arm7.elf
File opened for modification	/bin/watchdog	boatnet.arm7.elf

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/713/cmdline	boatnet.arm7.elf
File opened for reading	/proc/self/exe	boatnet.arm7.elf
File opened for reading	/proc/614/cmdline	boatnet.arm7.elf
File opened for reading	/proc/619/cmdline	boatnet.arm7.elf
File opened for reading	/proc/665/cmdline	boatnet.arm7.elf
File opened for reading	/proc/701/cmdline	boatnet.arm7.elf
File opened for reading	/proc/717/cmdline	boatnet.arm7.elf
File opened for reading	/proc/458/cmdline	boatnet.arm7.elf
File opened for reading	/proc/461/cmdline	boatnet.arm7.elf
File opened for reading	/proc/683/cmdline	boatnet.arm7.elf
File opened for reading	/proc/705/cmdline	boatnet.arm7.elf
File opened for reading	/proc/707/cmdline	boatnet.arm7.elf

/tmp/boatnet.arm7.elf
/tmp/boatnet.arm7.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads