Analysis
-
max time kernel
130s -
max time network
147s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
-
submitted
16/03/2025, 10:52
General
-
Target
EdiAf.mips.elf
-
Size
33KB
-
MD5
c4f7cdbe479564e7e913cf9d449f2c04
-
SHA1
d9641d31a480df940d8d0ab6ad582a987340cbd6
-
SHA256
38dd9a1bbb448b1492fa65ac97538832f9be9b5a215d1a4b3cb7b77cf438abe1
-
SHA512
85876d991462d61110f931645df794f68776e049973291b7e7191815c2cb9a7ec20ac7c1b30fd43361d562c72837f73cbb684993b128c63201d35c98dd87b968
-
SSDEEP
768:Do4ix6rNOUWcSYTdV6Z0uOqyqPip6NP5OJgGlzDpUYsbL:DUxwdXJV6mu1yCN4VqYYL
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
UNSTABLE
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Deletes itself 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 2 IoCs
-
Changes its process name 1 IoCs
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/EdiAf.mips.elf/tmp/EdiAf.mips.elf1⤵
- Deletes itself
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
- Reads runtime system information
- System Network Configuration Discovery