mirai | 1712683bcb24f8960fe4e934bccb42f9db9821e9bcdb7e7cdacc009608b5771f

Analysis

max time kernel
100s
max time network
12s
platform
debian-12_mipsel
resource
debian12-mipsel-20240221-en
resource tags

arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
01-01-2025 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
Size

24KB
MD5

8b4beb13f7163c0bdfc10a573f22d202
SHA1

41f4ff8938e7ebe5967e66d640bf4bbc358b913d
SHA256

98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c
SHA512

6fb1faa63b736adc50edd7355baa9c2405b9d201f575ae068f9f1666988fdf67d8dfb524f426bea5f5b566c97e01930858c519ae9b627ec7171088ff2312072e
SSDEEP

768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpeZqEWvN:/QlS07FUXqIYSXQKquyqz

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for modification	/dev/misc/watchdog	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for modification	/bin/watchdog	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf

Reads runtime system information 20 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/428/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/681/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/698/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/715/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/753/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/764/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/807/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/668/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/711/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/723/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/699/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/762/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/805/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/808/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/680/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/720/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/738/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/739/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/741/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
File opened for reading	/proc/809/cmdline	98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf

/tmp/98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
/tmp/98e5634d3ac10b50b0bdeb0f925d98201c10c9743a829125d7f323b5b28b486c.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:750

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads