Overview

overview

10

Static

static

5

45.200.149...00.elf

debian-9-armhf

10

Analysis

  • max time kernel
    149s
  • max time network
    16s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    28-12-2024 02:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    45.200.149.186-boatnet.arm-2024-12-28T012300.elf

  • Size

    21KB

  • MD5

    3eda2f6680311edb6fde1cbb70c1377a

  • SHA1

    0a5eff32c5116c1d67056fa29ff09a9371d0c29e

  • SHA256

    b59927d9759ef2ac0c2e6365b0d5c14bd24d410a3af35183dbae35d496dcc93f

  • SHA512

    bf400c45c655077e56c8645ba4cf2999215aa2504664fa38477a4b7abadaf9975ac764fb38ea6cf32a7d5a84451a54da5f89e6bf204dfd77c3c409a7c0f0e20d

  • SSDEEP

    384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjHhymdGUop5hw:vvQn4j+ZO5fKAlxLs3Uozi

Score
10/10
mirailzrdbotnetdefense_evasiondiscovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 2 IoCs
  • Reads runtime system information 32 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/45.200.149.186-boatnet.arm-2024-12-28T012300.elf
    /tmp/45.200.149.186-boatnet.arm-2024-12-28T012300.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Reads runtime system information
    PID:646

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads