Overview

overview

10

Static

static

5

boatnet.arm7.elf

debian-12-armhf

10

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20240221-en
  • resource tags

    arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    30/12/2024, 18:58 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    boatnet.arm7.elf

  • Size

    54KB

  • MD5

    d3e1dee0e16f2c83a674e001115792ef

  • SHA1

    806f08d4e8813a02f3b45a6986465e0f38225c07

  • SHA256

    9bcddc690d77a68cdc4068ebc02c367bbc58053f26749a7a820e5d3d34d58c44

  • SHA512

    1feae8a01c7f46a2422204282f9b70934add13e577805eeec97b63f4c39bf495c2707b40c7d6211aa2d9dcdf5668fd380e4771400cdfedfe6d8d21cff7d6935e

  • SSDEEP

    1536:4IHiFvo89yZXGH3+0BuSM9LwFFv25L6tBiMvcw:4Xvo89y9QAt9LwvYL23vf

Score
10/10
mirailzrdbotnetdefense_evasiondiscovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Writes file to system bin folder 2 IoCs
  • Reads runtime system information 17 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/boatnet.arm7.elf
    /tmp/boatnet.arm7.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Reads runtime system information
    PID:710

Network

  • flag-us
    DNS
    debian12-armhf-20240221-en-3
    Remote address:
    1.1.1.1:53
    Request
    debian12-armhf-20240221-en-3
    IN AAAA
    Response
  • flag-us
    DNS
    debian12-armhf-20240221-en-3
    Remote address:
    1.1.1.1:53
    Request
    debian12-armhf-20240221-en-3
    IN A
    Response
  • flag-us
    DNS
    debian12-armhf-20240221-en-3
    Remote address:
    1.1.1.1:53
    Request
    debian12-armhf-20240221-en-3
    IN AAAA
    Response
  • flag-us
    DNS
    debian12-armhf-20240221-en-3
    Remote address:
    1.1.1.1:53
    Request
    debian12-armhf-20240221-en-3
    IN A
    Response
  • flag-us
    DNS
    0.debian.pool.ntp.org
    Remote address:
    1.1.1.1:53
    Request
    0.debian.pool.ntp.org
    IN A
    Response
  • flag-us
    DNS
    0.debian.pool.ntp.org
    Remote address:
    1.1.1.1:53
    Request
    0.debian.pool.ntp.org
    IN AAAA
    Response
    0.debian.pool.ntp.org
    IN A
    176.58.109.199
    0.debian.pool.ntp.org
    IN A
    109.74.206.120
    0.debian.pool.ntp.org
    IN A
    178.215.228.24
    0.debian.pool.ntp.org
    IN A
    77.68.81.77
  • 154.216.17.216:3778
    325 B
     216 B
     6
    4
  • 1.1.1.1:53
    debian12-armhf-20240221-en-3
    dns
    74 B
     149 B
     1
    1

    DNS Request

    debian12-armhf-20240221-en-3

  • 1.1.1.1:53
    debian12-armhf-20240221-en-3
    dns
    74 B
     149 B
     1
    1

    DNS Request

    debian12-armhf-20240221-en-3

  • 1.1.1.1:53
    debian12-armhf-20240221-en-3
    dns
    74 B
     149 B
     1
    1

    DNS Request

    debian12-armhf-20240221-en-3

  • 1.1.1.1:53
    debian12-armhf-20240221-en-3
    dns
    74 B
     149 B
     1
    1

    DNS Request

    debian12-armhf-20240221-en-3

  • 1.1.1.1:53
    0.debian.pool.ntp.org
    dns
    134 B
     253 B
     2
    2

    DNS Request

    0.debian.pool.ntp.org

    DNS Request

    0.debian.pool.ntp.org

    DNS Response

    176.58.109.199
    109.74.206.120
    178.215.228.24
    77.68.81.77

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.