mirai | 5e6bc0fa8fe12d12ca1f1ded09a13a015ed6dc14e8cc5043c7b929e044d31c70

Analysis

max time kernel
151s
max time network
9s
platform
debian-12_mipsel
resource
debian12-mipsel-20240221-en
resource tags

arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
07/01/2025, 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
Size

24KB
MD5

c37ecb46ae324008a733e16138c567fc
SHA1

34f5a1b3dbfd0436c02a9352b408d14f6ca2a92a
SHA256

d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60
SHA512

0475acb8cbbfc842e3e889eeeb06d81fea8bb95d056a87e110b945d3fdc2f6f327a10df08d71f17a16325368623299af9bddf2ab5fd9a14f6e419b4db6806317
SSDEEP

768:gDrQlS07dEv0UXqUhvQE+CXQKMQKCXBpyzZqyWvE:oQlS07FUXqIYSXQKqu0qc

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for modification	/dev/misc/watchdog	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for modification	/bin/watchdog	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf

Reads runtime system information 15 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/710/cmdline	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for reading	/proc/720/cmdline	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for reading	/proc/733/cmdline	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for reading	/proc/753/cmdline	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for reading	/proc/411/cmdline	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for reading	/proc/698/cmdline	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for reading	/proc/732/cmdline	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for reading	/proc/667/cmdline	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for reading	/proc/680/cmdline	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for reading	/proc/747/cmdline	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for reading	/proc/407/cmdline	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for reading	/proc/433/cmdline	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for reading	/proc/679/cmdline	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for reading	/proc/695/cmdline	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
File opened for reading	/proc/718/cmdline	d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf

/tmp/d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
/tmp/d427cd5ac2c772a3c95a1615737508252dec671df6bcf526ab206b9770aa5a60.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:743

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...