mirai | 98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c

Analysis

max time kernel
149s
max time network
8s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
30-12-2024 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boatnet.mpsl.elf
Size

24KB
MD5

8b4beb13f7163c0bdfc10a573f22d202
SHA1

41f4ff8938e7ebe5967e66d640bf4bbc358b913d
SHA256

98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c
SHA512

6fb1faa63b736adc50edd7355baa9c2405b9d201f575ae068f9f1666988fdf67d8dfb524f426bea5f5b566c97e01930858c519ae9b627ec7171088ff2312072e
SSDEEP

768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpeZqEWvN:/QlS07FUXqIYSXQKquyqz

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	boatnet.mpsl.elf
File opened for modification	/dev/misc/watchdog	boatnet.mpsl.elf

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	boatnet.mpsl.elf
File opened for modification	/bin/watchdog	boatnet.mpsl.elf

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/768/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/779/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/669/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/675/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/686/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/704/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/705/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/734/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/791/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/700/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/716/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/767/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/804/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/676/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/706/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/710/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/713/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/771/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/430/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/666/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/699/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/740/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/741/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/803/cmdline	boatnet.mpsl.elf

/tmp/boatnet.mpsl.elf
/tmp/boatnet.mpsl.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:707

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads