mirai | 09c420c586b99c62c79f16356522e16c861c4e22ab61e139cd238eae5a711f22

Analysis

max time kernel
147s
max time network
152s
platform
debian-12_armhf
resource
debian12-armhf-20240729-en
resource tags

arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
18/03/2025, 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EdiAf.arm7.elf
Size

57KB
MD5

d7e5879abcb07c7b482ba0a5f69444d1
SHA1

13d5098600d73aacaf862f5b973e6e93e5991993
SHA256

09c420c586b99c62c79f16356522e16c861c4e22ab61e139cd238eae5a711f22
SHA512

a1ec783989f3ff09f436ef1607ceb2ecbeda037bf53f03df10c8ef7fb27d217abcee7a87ea9e9d4fc1933a9efbbdb3b8912f510df6afa89c7c86ffc98bc7b0e2
SSDEEP

1536:HPrFFzOzcK4gpsmqXv5m/40u4uu2f0O+2sMuP+P1:HPPOzuX/qg4uuSFuPQ

Score

10^/10

mirai unstable botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Deletes itself 1 IoCs

pid	Process
704	EdiAf.arm7.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	EdiAf.arm7.elf
File opened for modification	/dev/watchdog	EdiAf.arm7.elf

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	EdiAf.arm7.elf
File opened for modification	/bin/watchdog	EdiAf.arm7.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	f7w7hdcafwkautk2	704	EdiAf.arm7.elf

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	EdiAf.arm7.elf
File opened for reading	/proc/self/exe	EdiAf.arm7.elf

/tmp/EdiAf.arm7.elf
/tmp/EdiAf.arm7.elf
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
- Reads runtime system information
PID:704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads