Analysis
-
max time kernel
149s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
-
submitted
08/03/2025, 04:40
General
-
Target
2d8a8e332cac45a6a3c6e6ceb43ea2e17516595231845f241c29756293fc34bd.elf
-
Size
47KB
-
MD5
4cf65fb24e75069b21eee31ea06b6450
-
SHA1
b76bcd100bd10ff9a3015ac44cccb51bc63e8f7a
-
SHA256
2d8a8e332cac45a6a3c6e6ceb43ea2e17516595231845f241c29756293fc34bd
-
SHA512
d97ba3317f5984e18a834fd2a1491930ff8e248e7d4d888d30f176d4eedc3d0e399a4062e6331d50e19abc7b681fe0452c77d4b3d6773a7a97439da66bdec723
-
SSDEEP
768:rzkbydRjkpM9sBIc6lxn7JSaPQTAXjDaD8TTRd+Qwm21MbCe7bQIKNs3Uozy:rAbysC9PcMlbFjDu8RQbFMbbHQFQzy
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Contacts a large (23954) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/2d8a8e332cac45a6a3c6e6ceb43ea2e17516595231845f241c29756293fc34bd.elf/tmp/2d8a8e332cac45a6a3c6e6ceb43ea2e17516595231845f241c29756293fc34bd.elf1⤵
- Modifies Watchdog functionality
- Reads runtime system information