mirai | 43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e

Resubmissions

15-01-2025 15:18

250115-sp5c3swpds 10

15-01-2025 14:48

250115-r6fwdawjcv 10

Analysis

max time kernel
149s
max time network
132s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
15-01-2025 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ub8ehJSePAfc9FYqZIT6.x86_64.elf
Size

17KB
MD5

eadf195933f9d4ba0fc3687b56fcf912
SHA1

a0b4328d78fb5746529d2f5e1db26e1074013a58
SHA256

43d60410699abf69677eef78eed754d524b8cb8035e344d2ab24f7133ad0b34e
SHA512

dd8aefa57936685c0aca304777fb7cf8e20fe1760e0c795981e9091946a6c4928dc0416593e3ab831eca5db2e8b0b089f786ab74cef52c2a32f7d0373227ffb9
SSDEEP

384:llWw+Jg28pCVYNFZIpU4RiRvmxPlPtAutTWcaiFqcJ0y:mw+VGZh4GvIWbsCy

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for modification	/dev/misc/watchdog	ub8ehJSePAfc9FYqZIT6.x86_64.elf

Traces itself 1 IoCs

Traces itself to prevent debugging attempts

pid	Process
2783	ub8ehJSePAfc9FYqZIT6.x86_64.elf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for modification	/bin/watchdog	ub8ehJSePAfc9FYqZIT6.x86_64.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/2601/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/771/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2149/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2257/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2330/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2553/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/793/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/1111/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2490/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2769/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2779/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/1107/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/1341/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2034/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2642/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/456/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/790/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2307/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2311/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2139/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2234/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2261/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2559/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2572/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2151/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2489/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/1064/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/1078/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2037/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2329/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2511/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2654/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/1046/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/1052/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2245/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2306/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2478/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2185/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2424/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/1058/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2314/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2352/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2495/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2464/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/510/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/792/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2506/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2627/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/1061/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2047/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2275/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2323/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/780/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2297/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2548/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/431/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/734/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2039/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2315/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/1115/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2647/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/2827/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/437/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf
File opened for reading	/proc/1254/cmdline	ub8ehJSePAfc9FYqZIT6.x86_64.elf

/tmp/ub8ehJSePAfc9FYqZIT6.x86_64.elf
/tmp/ub8ehJSePAfc9FYqZIT6.x86_64.elf
1⤵
- Modifies Watchdog functionality
- Traces itself
- Writes file to system bin folder
- Reads runtime system information
PID:2783

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads