General

  • Target

    boatnet.arm.elf

  • Size

    29KB

  • Sample

    250209-ttwgeawrbt

  • MD5

    45b44fc64a21b2999998e0c1447d9f4d

  • SHA1

    a4eb031abb2cb804986681a6ca43e3324a1ca400

  • SHA256

    bdc3fd9f22538e06cc9cecf05b00f67832e118113b54608a0da184416d5d97e7

  • SHA512

    c113156bf00668e6e03863842c8123baf5276e3005b01248d304325fce0023368c98072aa546683eabc84f9c29241aa4dc3b64aa447d0c28e167907e1f5a1430

  • SSDEEP

    768:h1dfMnOoILekkypuybZHi1MvOU7flPgJ6fhuVs3Uoz4:h17rLU/ybhzGmgJ6fhxz4

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      boatnet.arm.elf

    • Size

      29KB

    • MD5

      45b44fc64a21b2999998e0c1447d9f4d

    • SHA1

      a4eb031abb2cb804986681a6ca43e3324a1ca400

    • SHA256

      bdc3fd9f22538e06cc9cecf05b00f67832e118113b54608a0da184416d5d97e7

    • SHA512

      c113156bf00668e6e03863842c8123baf5276e3005b01248d304325fce0023368c98072aa546683eabc84f9c29241aa4dc3b64aa447d0c28e167907e1f5a1430

    • SSDEEP

      768:h1dfMnOoILekkypuybZHi1MvOU7flPgJ6fhuVs3Uoz4:h17rLU/ybhzGmgJ6fhxz4

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Mirai family

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks