Analysis

  • max time kernel
    130s
  • max time network
    34s
  • platform
    debian-12_mipsel
  • resource
    debian12-mipsel-20240221-en
  • resource tags

    arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
  • submitted
    10-12-2024 01:07

General

  • Target

    2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf

  • Size

    24KB

  • MD5

    302bc8811041c2f816f8bf82fed28473

  • SHA1

    ebb9ebd1df93353b9d928b609848a775bdeb3071

  • SHA256

    2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568

  • SHA512

    f2c94ef641ef7e42913baef3a4c299f450652b6e22849f0818f6738a7d933dce2002f6b0b3fe8a2553d6ef4658e9cdfb15207289b5e104cdc34479be70df699d

  • SSDEEP

    768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpZZqSWvd:4QlS07FUXqIYSXQKquPqF

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 2 IoCs
  • Reads runtime system information 27 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf
    /tmp/2cdb081c1828de59669f777c0f6a867acde762d2201f169887e33b133a91b568.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Reads runtime system information
    PID:741

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads