mirai | 256d593a533d23bb0dc5632f46ec78f3013238b30e9752743ac54e07c22b733e

Analysis

max time kernel
149s
max time network
146s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20250307-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
23/03/2025, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x86_64.elf
Size

28KB
MD5

7851753edd9a4ba9f8a3d983962c0be6
SHA1

58202770c5e899ecb5b6b40dd83aa97a3f5b6b18
SHA256

256d593a533d23bb0dc5632f46ec78f3013238b30e9752743ac54e07c22b733e
SHA512

5a73577fd8f7d8204afc1b03ba1c0ca8b932d40caa524da086cd14da7ed20c52b8baf5f0d776d1fdbe59ea227c044f3b84f5ed9171107ca614f34849bbe61a3f
SSDEEP

384:emRTiFy9E8cH0+mT3A/HQtPR3p8+DUfpWo6RusUSjLgV/7WrqRV5VcGhc8mLFwYP:emUoJ13MQXKyyp3IyYLKlELF1w0OsH

Score

10^/10

mirai mirai botnet defense_evasion

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Deletes itself 1 IoCs

pid	Process
1570	x86_64.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	x86_64.elf
File opened for modification	/dev/misc/watchdog	x86_64.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	ca20mejb85c6830nssqs	1570	x86_64.elf

/tmp/x86_64.elf
/tmp/x86_64.elf
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Changes its process name
PID:1570

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads