mirai | 1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8

Analysis

max time kernel
149s
max time network
5s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
02/02/2025, 04:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
Size

23KB
MD5

bc40ed039ebc37e909bf79dee3fc63dd
SHA1

e13f7f6b07eed473ed707ead81336d09c174fe26
SHA256

1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8
SHA512

f3269464e6564dd52069a3b5a5ab032bc75cc3454e9c674fb0f1b5c25b279dbfd0bef8881324cd2018214eb27123d8806b42c2cd3d46d8290db004d9e0ff29e3
SSDEEP

384:oeD8ZSH2LLZUYyGZbsOiTjYAxd7fqWVZfV/Pncb8Q3md9JgGlzDpH7uNj1JA4r:oeD8ZSWvZHZbs1UAxd7iEZ68Ei9JgGl6

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for modification	/dev/misc/watchdog	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/bin/watchdog	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for modification	/sbin/watchdog	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf

Reads runtime system information 21 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/684/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/695/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/713/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/715/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/719/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/789/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/675/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/678/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/709/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/725/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/744/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/758/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/781/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/815/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/433/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/685/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/777/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/708/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/714/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/722/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
File opened for reading	/proc/801/cmdline	1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf

/tmp/1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
/tmp/1be305c089fa7aa88e967d7bc0ea4d7d76c07f879df2b3ee445dfaa0ccb8e8b8.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...