Overview

overview

10

Static

static

5

72.14.155....11.elf

debian-12-mipsel

10

Analysis

  • max time kernel
    151s
  • max time network
    11s
  • platform
    debian-12_mipsel
  • resource
    debian12-mipsel-20240221-en
  • resource tags

    arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
  • submitted
    29-12-2024 06:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    72.14.155.77-boatnet.mpsl-2024-12-29T044911.elf

  • Size

    27KB

  • MD5

    c8e704d38ddd5650f9a94e4f1e28e6da

  • SHA1

    377624921fe5998f4fa54fd18cdbf2bb54d4d437

  • SHA256

    ad5560d1cc3e576c3b34dbe6871cdeb2afa4de4293114cae565454f4dc8d89ea

  • SHA512

    8e30a51c7fec1dcf1a5e76f5f50da256dcb90e4b0a40222967d39f935489cf91ffb76259a315935fcf062f421e848013e0ba8608c2b69646fb0c6ed7a7c65fdb

  • SSDEEP

    384:AmpTqrBMyz2ZpRcZbsZGBdHIwFrs1PY1a910Jxc5s3ArKKLYF14Bo0MZRWGVCz0Z:AmFqrG9zcZe2HI0rA/9Gxd/14fKWu

Score
10/10
mirailzrdbotnetdefense_evasiondiscovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Writes file to system bin folder 2 IoCs
  • Reads runtime system information 14 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/72.14.155.77-boatnet.mpsl-2024-12-29T044911.elf
    /tmp/72.14.155.77-boatnet.mpsl-2024-12-29T044911.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Reads runtime system information
    PID:739

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads