mirai | df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b

Analysis

max time kernel
149s
max time network
3s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
30/01/2025, 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
Size

31KB
MD5

a3f3778643c6a91419d6f816e3c5276a
SHA1

315ee49ad3c63d2d06ed459023cce08d2a8df9cc
SHA256

df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b
SHA512

68d76dba589e9ce70b320a521372046adeff79001a6d09078cac629b203a4fb850ffa5619edc5fe2ea412e9e5bad3a0ac4511d30aa37e02d7dbd91490ff4daa8
SSDEEP

768:CkGVUFmXbht/vrCgNEAXtKWNcuOTl2N6IFGaMJgGlzDpbuR1JS:F0XbveAXtKkOTkN6hNVJuY

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for modification	/dev/misc/watchdog	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for modification	/bin/watchdog	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf

Reads runtime system information 19 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/670/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/730/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/738/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/798/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/723/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/725/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/786/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/422/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/663/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/704/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/718/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/666/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/669/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/790/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/830/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/719/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/724/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/732/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
File opened for reading	/proc/779/cmdline	df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf

/tmp/df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
/tmp/df53be32419476d16ae7ea65a6250bf34d49488e74116ef18cebbe3ffb866a7b.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:726

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...