mirai | ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d

Analysis

max time kernel
102s
max time network
22s
platform
debian-12_mipsel
resource
debian12-mipsel-20240221-en
resource tags

arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
27-12-2024 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
Size

32KB
MD5

7b6a0d1494f6b4ba205b617ec1c0db92
SHA1

a42097911d601007d6f984da9e4f27b8cd321890
SHA256

ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d
SHA512

a1f21518dd961be8ed30ac7b4437dc6711c2c3f5bfc4678ec0515df7f7359e73f6adfa8d926cdbb6bd5d2a734cb42b7967fcc841975ad291ecdc7fe3d462015b
SSDEEP

768:yTHURFhp2WO6F92V+NiH3LOYX+OzCW3mIWu:yT0RFj256buZX+YCW3z

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for modification	/dev/watchdog	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/bin/watchdog	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for modification	/sbin/watchdog	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/722/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/767/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/809/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/409/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/718/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/742/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/807/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/808/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/691/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/737/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/431/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/689/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/719/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/793/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/805/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/412/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/611/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/710/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/712/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/752/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/756/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/694/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/736/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/792/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/806/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/607/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/714/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
File opened for reading	/proc/791/cmdline	ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf

/tmp/ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
/tmp/ecce1fb884e0edac5dd3f3c0ca3d3a42ce8c552e5fce2235ac65ecf982c2826d.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads