Analysis
-
max time kernel
150s -
max time network
141s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
-
submitted
31/12/2024, 03:00
General
-
Target
d995822d452a92285cfe97658c2ee62f8f8fd55439d6daf84b06c84ab6196d14.elf
-
Size
33KB
-
MD5
0a88c4f37f94f22f13ba7fbafc59f8db
-
SHA1
b49ac1f54aacc8fd24b6db3206ce9082a0528492
-
SHA256
d995822d452a92285cfe97658c2ee62f8f8fd55439d6daf84b06c84ab6196d14
-
SHA512
e8b68041bc6fedd20a7a468fe8b401502438eec4186d34e9df6e51af0890d77987106d405bbbc1fa1a344ca1056a225833d1cb1c11ea5a2771db3c8c88fbd129
-
SSDEEP
768:QyqTG+N2S+JiE0o0u/ygPTXiz3ljvUCLTyz0MmV5i5dwO1TmJgGlzDpbuR1JUz:wfN2GE0U/vPTXiRjtL60McAaMSVJuKz
Score
10/10
Malware Config
Extracted
Family
mirai
C2
e.xijinping.mov
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Deletes itself 1 IoCs
-
Traces itself 1 IoCs
Traces itself to prevent debugging attempts
-
Writes file to system bin folder 2 IoCs
-
Changes its process name 1 IoCs
-
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/d995822d452a92285cfe97658c2ee62f8f8fd55439d6daf84b06c84ab6196d14.elf/tmp/d995822d452a92285cfe97658c2ee62f8f8fd55439d6daf84b06c84ab6196d14.elf1⤵
- Deletes itself
- Traces itself
- Writes file to system bin folder
- Changes its process name
- Writes file to tmp directory