mirai | 3cdfe20a0f79e0d552fddb5d7a881725ac4dd8312e433a65990b55adafd2c0b3

Analysis

max time kernel
150s
max time network
31s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
08-01-2025 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boatnet.mpsl.elf
Size

24KB
MD5

4c239b88c1d333308ed42706769d14c6
SHA1

3c6ebc5b02673e2b03447facebf724a1db297ce4
SHA256

3cdfe20a0f79e0d552fddb5d7a881725ac4dd8312e433a65990b55adafd2c0b3
SHA512

b0496f6441cb5ff7a12e62d30adaf5e117ad0f981d79aec8fcb0e716bdab7d6d8c4f5bebfe4fcf0b597a9f95d3c9a25e1159f2ae287429dc4991e18882a2282d
SSDEEP

768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpIpZqSWvR:4QlS07FUXqIYSXQKquwq5

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	boatnet.mpsl.elf
File opened for modification	/dev/misc/watchdog	boatnet.mpsl.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	boatnet.mpsl.elf
File opened for modification	/bin/watchdog	boatnet.mpsl.elf

Reads runtime system information 34 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/509/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/701/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/703/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/749/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/753/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/802/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/806/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/501/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/713/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/740/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/761/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/784/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/707/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/705/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/718/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/721/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/475/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/776/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/790/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/711/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/767/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/700/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/712/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/814/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/468/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/722/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/706/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/731/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/732/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/739/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/772/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/779/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/780/cmdline	boatnet.mpsl.elf
File opened for reading	/proc/686/cmdline	boatnet.mpsl.elf

/tmp/boatnet.mpsl.elf
/tmp/boatnet.mpsl.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads