Analysis
-
max time kernel
150s -
max time network
143s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240226-en -
resource tags
-
submitted
30-12-2024 01:18
General
-
Target
.Smpsl.elf
-
Size
34KB
-
MD5
2558e70fd248e67a87a8e8a524bd3494
-
SHA1
86132f2f0c2edce94cfb20beedd9842943562fe8
-
SHA256
684602677456f6570d116ea4c283b959f24110f51da5faa823ef429110de7d42
-
SHA512
efb1a41d67f634c24045c761e0c22abbc816bcf64c4c886ef8fbcd73a91ca1c7f20d35e4605a1a2f89112554e805cf5482170154e18531b423b1c100359440ee
-
SSDEEP
768:1j0q4nUaD5o2BvwdwpW44wiAroI7MloMjfU8Wh:t0Dl5oD4LiArom0fU7
Score
10/10
Malware Config
Extracted
Family
mirai
C2
e.xijinping.mov
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Deletes itself 1 IoCs
-
Traces itself 1 IoCs
Traces itself to prevent debugging attempts
-
Writes file to system bin folder 2 IoCs
-
Changes its process name 1 IoCs
-
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/.Smpsl.elf/tmp/.Smpsl.elf1⤵
- Deletes itself
- Traces itself
- Writes file to system bin folder
- Changes its process name
- Writes file to tmp directory