mirai | 2f2d3f1980929b0a2b8656563c68e0a96559c6ef8f5d3c8337cae704b2b6fc3b

Analysis

max time kernel
149s
max time network
152s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20250307-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
08/03/2025, 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f2d3f1980929b0a2b8656563c68e0a96559c6ef8f5d3c8337cae704b2b6fc3b.elf
Size

50KB
MD5

59b173c85153381d64435871845a41cf
SHA1

9b276c7cfd660d7546f8c9d1394012511f72d713
SHA256

2f2d3f1980929b0a2b8656563c68e0a96559c6ef8f5d3c8337cae704b2b6fc3b
SHA512

06fa36b3adb340a5a511731754ef95a6f7922a8c7c69144326c9b0e42f01bb334d356064794a1edd291728b544f2f74f6ed0de86f2c75517537f9ed9ca6465a0
SSDEEP

1536:l1sqfvYXEgf3hpfnRbfBI4Uc1qtKk0wSarmjt6:/hoUAnRbpI/c3kb9656

Score

10^/10

mirai lzrd botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (23917) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	2f2d3f1980929b0a2b8656563c68e0a96559c6ef8f5d3c8337cae704b2b6fc3b.elf
File opened for modification	/dev/misc/watchdog	2f2d3f1980929b0a2b8656563c68e0a96559c6ef8f5d3c8337cae704b2b6fc3b.elf

/tmp/2f2d3f1980929b0a2b8656563c68e0a96559c6ef8f5d3c8337cae704b2b6fc3b.elf
/tmp/2f2d3f1980929b0a2b8656563c68e0a96559c6ef8f5d3c8337cae704b2b6fc3b.elf
1⤵
- Modifies Watchdog functionality
PID:1547

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads