mirai | 2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655

Analysis

max time kernel
149s
max time network
147s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
05/01/2025, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
Size

45KB
MD5

bc01fb4b319cbeebf0de81aafc038d20
SHA1

7193ae7e285cb75b925feb709ca8c5701bffda1c
SHA256

2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655
SHA512

047ca84596a6c7aac380318b0fbd198bdc035097876c2fe3d94b233b90168aca2a1d07e83d173f8e020cf302928b3bd14748fd9fa3526461fe6db8bbca99a1bf
SSDEEP

768:D/TYCoIxdEk+AxoTZAZHFeq8b3Zp9q3UELbUXfi6nVMQHI4vcGpvx:DECFd+A6YHAxZcLRQZx

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for modification	/dev/misc/watchdog	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for modification	/bin/watchdog	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf

Reads runtime system information 17 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/646/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/665/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/679/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/683/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/705/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/734/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/735/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/632/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/647/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/662/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/714/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/727/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/self/exe	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/706/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/699/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/726/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
File opened for reading	/proc/755/cmdline	2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf

/tmp/2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
/tmp/2d7408b6f293dad0fe7d485d1434c91059f37ebd1cbc1d696ef2e79156d36655.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads