mirai | 2391664dc29890b86dba1ab496b4094142f7724cec9782a7e6608c087a8dc10a

Analysis

max time kernel
131s
max time network
150s
platform
debian-12_mipsel
resource
debian12-mipsel-20240418-en
resource tags

arch:mipselimage:debian12-mipsel-20240418-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
16/03/2025, 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EdiAf.mpsl.elf
Size

35KB
MD5

b41e6a801889903ff41f08abccf0e19b
SHA1

3cd1b8afb365f5e85f08426e521e0982d3037343
SHA256

2391664dc29890b86dba1ab496b4094142f7724cec9782a7e6608c087a8dc10a
SHA512

817452c4b52fa7ba580fd8d5c0acfa922b5303bb2555dabccfcb3d7410f6d981940667b33d646d859993ca04e8557cd6e2fb82d7ac8efae54e5fba94eeed4154
SSDEEP

768:o+kqz1tqN05Hlsmav4xVZSmQduZ2nXmmjT1WXG5WMc:4qz1tqG5z6mSznXXQG2

Score

10^/10

mirai unstable botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Deletes itself 1 IoCs

pid	Process
739	EdiAf.mpsl.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	EdiAf.mpsl.elf
File opened for modification	/dev/misc/watchdog	EdiAf.mpsl.elf

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	EdiAf.mpsl.elf
File opened for modification	/bin/watchdog	EdiAf.mpsl.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	5fvfokc6mne5pcib	739	EdiAf.mpsl.elf

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	EdiAf.mpsl.elf
File opened for reading	/proc/self/maps	EdiAf.mpsl.elf

/tmp/EdiAf.mpsl.elf
/tmp/EdiAf.mpsl.elf
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
- Reads runtime system information
PID:739

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads