Analysis
-
max time kernel
144s -
max time network
160s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
-
submitted
30-12-2024 01:19
General
-
Target
.Sarm7.elf
-
Size
56KB
-
MD5
4717d4355735701317c8ed18eda475c5
-
SHA1
0f9f3434b80f309d77406d9498a99f1781c82094
-
SHA256
4e26e5271b9eeaddec3969bfc3c20f4b348b2b02e1ed076471f46096ad62c5f6
-
SHA512
46b88ecffa655f6698e3ef9f85e29809fb301e1bb57663ef89e1cf470fe19d719c3460dd324a56e2b7a39da2882a16c570efb4668e263bf4f07b34e9674e1552
-
SSDEEP
1536:DCKWfy1sazvsUJO5f8knJzRU/hEnLeGg1tqW0xfbAMOARS:Zara/JO5ftnUpEnLeGAkWUjJ7S
Score
10/10
Malware Config
Extracted
Family
mirai
C2
e.xijinping.mov
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Deletes itself 1 IoCs
-
Traces itself 1 IoCs
Traces itself to prevent debugging attempts
-
Writes file to system bin folder 2 IoCs
-
Changes its process name 1 IoCs
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/.Sarm7.elf/tmp/.Sarm7.elf1⤵
- Deletes itself
- Traces itself
- Writes file to system bin folder
- Changes its process name
- Reads runtime system information
- Writes file to tmp directory