Analysis
-
max time kernel
149s -
max time network
158s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
-
submitted
30-12-2024 01:19
General
-
Target
.Sarm5.elf
-
Size
21KB
-
MD5
877aff442f5dcfb5e371139d70acb0a4
-
SHA1
6375d25b2cd970ce5930df870e9f366948a3a3fa
-
SHA256
6ebab62596ec65beccf22c8beace4aa0ad652ce5429e8462536b4a418270127e
-
SHA512
e740361643f62438c55a35a915582a215fd96f078aa8ce1ad3697bc05d844b0354ec7b0b7296e83b84b820fabaca68d47d636b89ee1db40c044551e44c2e7cad
-
SSDEEP
384:pHBOzXXfTNGUxX5S/B9dFg7Wg41Am/uShymdGUop5hl:hBOcsmM7341J/uSs3UozP
Score
10/10
Malware Config
Extracted
Family
mirai
C2
e.xijinping.mov
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Writes file to system bin folder 2 IoCs
-
Changes its process name 1 IoCs
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/.Sarm5.elf/tmp/.Sarm5.elf1⤵
- Writes file to system bin folder
- Changes its process name
- Reads runtime system information
- Writes file to tmp directory