General

  • Target

    boatnet.arm7.elf

  • Size

    128KB

  • Sample

    250331-kfkcjsykw3

  • MD5

    e44b012e4f88b5f85966751348e2512a

  • SHA1

    8f14aea728e88ca44b76daddabdc111477ba3305

  • SHA256

    b2013d9a456916c53197fe89c6ee954072955a1219faa2e2a626ed1866306569

  • SHA512

    9569b58f241ef210c74cbb76e9d7e6fceb3ae346dae9e29731ef874646dcef82dfa878e91deb72b067911a25cac1a4db50d224a40093acc7aad4d9185fba9e25

  • SSDEEP

    3072:ocb1PpBZBOhoN9MNS6pYO/zD4xEr/HSNM/9rik:ocb1PpBZBOGN9MNS6OO/PoErfQM/9rik

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      boatnet.arm7.elf

    • Size

      128KB

    • MD5

      e44b012e4f88b5f85966751348e2512a

    • SHA1

      8f14aea728e88ca44b76daddabdc111477ba3305

    • SHA256

      b2013d9a456916c53197fe89c6ee954072955a1219faa2e2a626ed1866306569

    • SHA512

      9569b58f241ef210c74cbb76e9d7e6fceb3ae346dae9e29731ef874646dcef82dfa878e91deb72b067911a25cac1a4db50d224a40093acc7aad4d9185fba9e25

    • SSDEEP

      3072:ocb1PpBZBOhoN9MNS6pYO/zD4xEr/HSNM/9rik:ocb1PpBZBOGN9MNS6OO/PoErfQM/9rik

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks