mirai | 3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1

Analysis

max time kernel
149s
max time network
4s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
10/01/2025, 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
Size

28KB
MD5

04eb6f71fd403232862308ce2979285c
SHA1

71be16349793aeb0b8937c9ff5e6f1ad986c816f
SHA256

3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1
SHA512

77142c240301fda1f5b8cab1e4e3b35cf2ba4bffdb88ae25f963f343e64373cb098f861ebdedc17370999a7900ee57778b41d13b019cfb5784fdc973054bb96d
SSDEEP

384:1mjOb/7xg3HAp0nwcOESKAhKDn459qfUscwA/75xPuC6DGCabvT95am2xZQ9RWGJ:aObTx2HrZOKAhn4UswxPu3GdZ5YXQLWg

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for modification	/dev/misc/watchdog	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for modification	/bin/watchdog	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf

Reads runtime system information 20 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/707/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/708/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/774/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/702/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/703/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/758/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/817/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/777/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/438/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/677/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/713/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/773/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/709/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/716/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/720/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/785/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/674/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/679/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/684/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
File opened for reading	/proc/685/cmdline	3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf

/tmp/3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
/tmp/3a45136d78a87712a7f05cad64d8c609a8a36f34028a8214c85a990282c218b1.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:710

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...