Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
-
submitted
09/03/2025, 11:11
General
-
Target
zyxel.elf
-
Size
54KB
-
MD5
6b3b44d5f4e66087f47cc7711f0ab15a
-
SHA1
9121311dd8b28cb456dd100763f61cc2182b0fb7
-
SHA256
a7f4ca9464e1cdf864aa3dda2ad26c8d6d8cdcf176a38788fde37abf97517989
-
SHA512
4bd08ba1e77995c158cf570dd86e8d974cf04f089f97150c1efbe70ee45f9fb720b1919507c46087a59f6e74889d0342dbd911f86886ccd8e7880a8948115acf
-
SSDEEP
1536:Yc9TkjuhNOxCFWF5IwosgDJMHvPygmLMF+3HJ1o5s4:YcZ8QC5boGqtL4+3Hbo5r
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
APEP
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Contacts a large (215826) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/zyxel.elf/tmp/zyxel.elf1⤵
- Changes its process name
- Reads runtime system information
- Writes file to tmp directory