Analysis

  • max time kernel
    135s
  • max time network
    146s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    23-12-2024 02:22

General

  • Target

    8b8facc7fb2d6cd6f278ea77711c41970dcdff8a367d2d04a2221fd4286ffb45.elf

  • Size

    34KB

  • MD5

    f66071f9e603dd7b96793058e206b45c

  • SHA1

    f90eaf59e5a2c5030450de5b1f12a72a8ec8f256

  • SHA256

    8b8facc7fb2d6cd6f278ea77711c41970dcdff8a367d2d04a2221fd4286ffb45

  • SHA512

    d5d307f49f255d8f2e36027cdb5b0b7171f83d99147fb1d074bdb64f4c65fa19a7af2556508e0a317a9a4e0df5bd005b5d1b3396282647d9672b12d916d3fc88

  • SSDEEP

    768:LzbGjwng3vdOhxV/Whew0IAls1SeGhRLN1Hv8s8xfp8AbanbcuyD7UHQRjj:fdnAzhe3rs2hRLbHv81tvanouy8Hyv

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 2 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/8b8facc7fb2d6cd6f278ea77711c41970dcdff8a367d2d04a2221fd4286ffb45.elf
    /tmp/8b8facc7fb2d6cd6f278ea77711c41970dcdff8a367d2d04a2221fd4286ffb45.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Reads runtime system information
    PID:1553

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads