Overview

overview

10

Static

static

5

176.65.134...16.elf

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    5s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240418-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    01-02-2025 02:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    176.65.134.111-boatnet.mpsl-2025-02-01T005916.elf

  • Size

    24KB

  • MD5

    524e436f63bb130c7b481ed8de84c6a2

  • SHA1

    3132b0c2f66a6e4f29b67a0bb18e99f02502bfc7

  • SHA256

    9453a1bdbd930939db68c216ea8350570049f5ff1e6c740d44e4f3ac9e614df0

  • SHA512

    1153f93885bfefc8b3c987d427118c9ae1bf4b441d0046ccbf728cba03e2fdc5511dcb25ba8fa5f43986c27402331a6576a83235b9c1544f2e51d236e0dd289e

  • SSDEEP

    768:chrQlS07dEv0UXqUhvQE+CXscKUnfHOOWS1ZqaWvp:KQlS07FUXqIYSXTnfOOWaqp

Score
10/10
mirailzrdbotnetdefense_evasiondiscovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Writes file to system bin folder 2 IoCs
  • Reads runtime system information 21 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/176.65.134.111-boatnet.mpsl-2025-02-01T005916.elf
    /tmp/176.65.134.111-boatnet.mpsl-2025-02-01T005916.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Reads runtime system information
    PID:721

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads