Analysis
-
max time kernel
149s -
max time network
6s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
-
submitted
27-12-2024 21:49
General
-
Target
109.176.30.237-boatnet.mips-2024-12-27T212118.elf
-
Size
23KB
-
MD5
4d1f66673a0e00578af906044a544b14
-
SHA1
34134b11a921104e531198020382b7659c3df889
-
SHA256
7f4087e0ff2f51b67b857a3d2da02cf930a55c0f8afec8f480250e357ae4b9d0
-
SHA512
5a6b008de604e03ec2accb92c3b189fc57d21dda63b3daff4f6e61132c10124e92e4466aec0c8196c1c5cb307234fdfc175833b7852849dfdf78d6d01555ff6a
-
SSDEEP
384:6eD8ZSH2LLZUYyGZbsOiTuUsUPii44nUtq/BSRPJ8oO0FlCmd1JgGlzDpH7uNj16:6eD8ZSWvZHZbs1uUxPvU8sRPiz0FYi17
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 2 IoCs
-
Reads runtime system information 20 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/109.176.30.237-boatnet.mips-2024-12-27T212118.elf/tmp/109.176.30.237-boatnet.mips-2024-12-27T212118.elf1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
- System Network Configuration Discovery