Analysis
-
max time kernel
149s -
max time network
7s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
-
submitted
02-01-2025 00:26
General
-
Target
45.95.169.120-mips-2025-01-02T001736.elf
-
Size
23KB
-
MD5
d70a9269f912109afaeec442fb967ce6
-
SHA1
0d89ccf6cb68f4d5b5f5a29d7f5de04984017b21
-
SHA256
5645309e550ef9e1afad4a0da0f577a3be054aec87122317d8a0a677d47496ab
-
SHA512
59817f04c9902c892b91469b8448431a641ea9e7fcc9fa9e87e317fdee1919d9a063f8bfc88fe90f9e9c40a3362ee2e5611f385c819e21ead39ea6148026e275
-
SSDEEP
384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiJjCVmdzJgGlzDpH7uNj1g:neD8ZSWvZHZbs1row697qohQvg9hCViN
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 2 IoCs
-
Reads runtime system information 21 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/45.95.169.120-mips-2025-01-02T001736.elf/tmp/45.95.169.120-mips-2025-01-02T001736.elf1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
- System Network Configuration Discovery