Analysis
-
max time kernel
77s -
max time network
151s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
-
submitted
05-01-2025 13:33
General
-
Target
z0r0.arm7.elf
-
Size
54KB
-
MD5
c2905cce39023437182165f4c484b703
-
SHA1
6a128613eca7ce76dc3a7e7bbe937575b54387b0
-
SHA256
39081308223a95724d945655162b54baca50acaaeff5110b45e4ec521ac5e603
-
SHA512
337fb0f5754be7e79639654f33d30be7402d289e2992712f00cece8f40ff5cf61a2f65dfeadaae809b056c980ec8d78f186d88fef01b6aeb4a687d3671c44d18
-
SSDEEP
768:vrI61Jcg2i2c5H6/fATljJfMHSNr8YL6mW+1N+q3UIIvCdyGQqf8QKf7:vd1igmcE/oTlleSNvTRIvCgGQqfm7
Malware Config
Extracted
mirai
UNSTABLE
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Contacts a large (147854) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 2 IoCs
-
Changes its process name 1 IoCs
-
Reads runtime system information 14 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/z0r0.arm7.elf/tmp/z0r0.arm7.elf1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
- Reads runtime system information