mirai | 7774cbb5827d8d53e7fdc56f44a8268a13420015f944d8deec12d06159273672

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240522.1-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
07/03/2025, 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7774cbb5827d8d53e7fdc56f44a8268a13420015f944d8deec12d06159273672.elf
Size

48KB
MD5

0eec7566f0c6fd2bee8f64951dba45c0
SHA1

de51f1a7acf717972906aa3bfea8f8541d4a8b7b
SHA256

7774cbb5827d8d53e7fdc56f44a8268a13420015f944d8deec12d06159273672
SHA512

23e2993b74793a91214971c86228fc812d4cfa3d6fe837b5d383db3dd1cb299ade73375e590c875f640de18a32b20e72ead4b13bfc7b25c94ce5b3ba00b07de6
SSDEEP

1536:pXJ8RQO/c+q2tnWrsxPdsTaSs9Hh5L5QQ:ETHq2tWQ9dsTCBCQ

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (23435) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	7774cbb5827d8d53e7fdc56f44a8268a13420015f944d8deec12d06159273672.elf
File opened for modification	/dev/misc/watchdog	7774cbb5827d8d53e7fdc56f44a8268a13420015f944d8deec12d06159273672.elf

/tmp/7774cbb5827d8d53e7fdc56f44a8268a13420015f944d8deec12d06159273672.elf
/tmp/7774cbb5827d8d53e7fdc56f44a8268a13420015f944d8deec12d06159273672.elf
1⤵
- Modifies Watchdog functionality
PID:1554

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...