mirai | 1726ad4bfe9045a38397c2166b5940b393f8da70843430b024b486add5820b71

Analysis

max time kernel
0s
max time network
146s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
13-12-2024 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fec20fde8f5cb8d571cee50a2bf8103c9e63c57b2bfd098693974389fd79c8d9.elf
Size

50KB
MD5

d5af8f2bb8c7c3e39981ba0099fa1d1c
SHA1

f12212c88dddb3c0298987b917c55063f942df88
SHA256

fec20fde8f5cb8d571cee50a2bf8103c9e63c57b2bfd098693974389fd79c8d9
SHA512

42b3455e467f11b68f000f6f375bd9d7f42d77c16184a3a6a36bbf4751e72a01b692032ee6d03a8ed398484cacbdb6231478d42099004f3674de84873c2e817e
SSDEEP

768:9WIA55yDHv3hnZji8OiWssyP151K8BLXJfiWkxnUGG3qQX9q3UELuFFjj3ytEJwc:9y5IThnZie151KKRi3UGOBmLufP3Huc

Score

10^/10

mirai botnet botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	fec20fde8f5cb8d571cee50a2bf8103c9e63c57b2bfd098693974389fd79c8d9.elf
File opened for modification	/dev/watchdog	fec20fde8f5cb8d571cee50a2bf8103c9e63c57b2bfd098693974389fd79c8d9.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	706	fec20fde8f5cb8d571cee50a2bf8103c9e63c57b2bfd098693974389fd79c8d9.elf

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	fec20fde8f5cb8d571cee50a2bf8103c9e63c57b2bfd098693974389fd79c8d9.elf

/tmp/fec20fde8f5cb8d571cee50a2bf8103c9e63c57b2bfd098693974389fd79c8d9.elf
/tmp/fec20fde8f5cb8d571cee50a2bf8103c9e63c57b2bfd098693974389fd79c8d9.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
- Reads runtime system information
PID:706

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads