Analysis
-
max time kernel
149s -
max time network
7s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
-
submitted
04-01-2025 00:12
General
-
Target
185.232.205.45-boatnet.mips-2025-01-03T235945.elf
-
Size
23KB
-
MD5
d99b45f2b169bb86b1d9e71192c3b6ea
-
SHA1
48552a2a77d46b2300e8923797eb6e0222853153
-
SHA256
b3d75dd9e223eb37d623996fb495fab727c39b77544a5a61b2af1559479b2d89
-
SHA512
f04906c7c4ae7744b497ebc1ebdde93ee346de7bebda0be7db79c685b2113cc002e9a79ad8b290036ef7c6e466f60f93231640577f9f1e47aeaab1dc76a135c6
-
SSDEEP
384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiupQmdzJgGlzDpH7uNj1J8:neD8ZSWvZHZbs1row697qohQvg9vizJV
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 2 IoCs
-
Reads runtime system information 23 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/185.232.205.45-boatnet.mips-2025-01-03T235945.elf/tmp/185.232.205.45-boatnet.mips-2025-01-03T235945.elf1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
- System Network Configuration Discovery