mirai | 29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520

Analysis

max time kernel
147s
max time network
151s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
14/01/2025, 02:17 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
Size

37KB
MD5

f6cbac4b6428c01a0e2df85f198a2c85
SHA1

ee4bffe3d9cb63e7ff1f20101c5d9b8ccf275ae2
SHA256

29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520
SHA512

8f158e91cd5c6797da5d1c2d8e5cb408983c135eb4f6a31e54716799ded43ddfe048a9d31f37625e3cd9036c2e9b4d4c7869a2532066d4f3a3a4bf2b2229053b
SSDEEP

768:CF4o5gt3IEG6Ks1mqDUKf+8hr89kxcEDV/SLXQlov0zBZLvad4mwu0eci7zzW/:El5JnsrXvrKy9QjyBZLvDmR0GPS

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for modification	/dev/watchdog	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for modification	/bin/watchdog	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/79/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/13/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/21/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/78/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/143/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/372/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/5/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/70/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/484/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/695/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/37/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/72/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/36/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/520/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/12/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/14/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/73/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/319/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/3/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/7/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/9/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/71/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/228/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/320/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/348/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/519/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/680/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/2/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/20/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/702/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/4/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/696/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/22/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/321/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/23/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/67/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/114/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/148/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/350/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/395/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/8/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/16/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/470/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/10/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/11/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/165/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/316/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/700/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/24/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/74/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/82/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/113/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/15/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/17/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/698/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/707/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/18/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/77/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/701/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/704/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/19/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/76/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/104/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
File opened for reading	/proc/370/status	29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf

/tmp/29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
/tmp/29ed081ca6cc35e1c5b875da687eedcbde9a58249d0e75e973388f85c5691520.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:704

Network

No results found

154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

120 B
80 B
2
2
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

120 B
80 B
2
2
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

120 B
80 B
2
2
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

60 B
40 B
1
1
154.213.187.11:3778

240 B
40 B
4
1
154.213.187.11:3778

180 B
40 B
3
1

No results found

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.