Overview

overview

10

Static

static

10

3ade73c820...7f.elf

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    30s
  • max time network
    147s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260126-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    26/04/2026, 09:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3ade73c820f24864b0e9fa86d49d2cb0c22d5d520c1b0397651d705fbae9887f.elf
  • Size 85KB
  • Sample260426-lsztfaft7m
  • SHA256 3ade73c820f24864b0e9fa86d49d2cb0c22d5d520c1b0397651d705fbae9887f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
antivmbotnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

Malware Config

Extracted

Family

  • mirai

C2

  • 5.175.249.163

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Deletes Audit logs 1 TTPs 1 IoCs

    Deletes logs related to the Linux Audit framework.

    defense_evasion
  • Deletes journal logs 1 TTPs 2 IoCs

    Deletes systemd journal logs. Likely to evade detection.

    defense_evasion
  • Deletes system logs 1 TTPs 1 IoCs

    Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    defense_evasion
  • Checks SCSI settings 1 TTPs 1 IoCs

    Checks list of SCSI devices which may be used to detect VMware or VirtualBox.

    antivm
  • Checks hardware identifiers (DMI) 1 TTPs 1 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Deletes log files 1 TTPs 1 IoCs

    Deletes log files on the system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Writes file to system bin folder 1 IoCs
  • Changes its process name 1 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/3ade73c820f24864b0e9fa86d49d2cb0c22d5d520c1b0397651d705fbae9887f.elf
    /tmp/3ade73c820f24864b0e9fa86d49d2cb0c22d5d520c1b0397651d705fbae9887f.elf
    1⤵
    • Deletes Audit logs
    • Deletes journal logs
    • Deletes system logs
    • Checks SCSI settings
    • Checks hardware identifiers (DMI)
    • Deletes log files
    • Modifies rc script
    • Writes file to system bin folder
    • Changes its process name
    • Reads system network configuration
    • Reads runtime system information
    PID:1521
    • /bin/sh
      sh -c "(crontab -l ; echo \"@reboot /bin/.morte\") | crontab -"
      2⤵
        PID:1522
        • /usr/bin/crontab
          crontab -
          3⤵
          • Creates/modifies Cron job
          PID:1524
        • /usr/bin/crontab
          crontab -l
          3⤵
            PID:1525

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Scheduled Task/Job

            1
            T1053

            Cron

            1
            T1053.003

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Boot or Logon Initialization Scripts

            1
            T1037

            RC Scripts

            1
            T1037.004

            Scheduled Task/Job

            1
            T1053

            Cron

            1
            T1053.003

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Boot or Logon Initialization Scripts

            1
            T1037

            RC Scripts

            1
            T1037.004

            Scheduled Task/Job

            1
            T1053

            Cron

            1
            T1053.003

            Defense Evasion

            Indicator Removal

            4
            T1070

            Clear Linux or Mac System Logs

            4
            T1070.002

            Virtualization/Sandbox Evasion

            2
            T1497

            System Checks

            2
            T1497.001

            Credential Access

            Discovery

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Virtualization/Sandbox Evasion

            2
            T1497

            System Checks

            2
            T1497.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            .morte
            • Path /bin/.morte
            • Size 85KB
            • SHA256 3ade73c820f24864b0e9fa86d49d2cb0c22d5d520c1b0397651d705fbae9887f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tmp.XphO1R
            • Path /var/spool/cron/crontabs/tmp.XphO1R
            • Size 195B
            • SHA256 5defd0befd7d21f5702418d472dfb44021bcdcc0a1cb1c135235242cda9dbd3c
            • MD5 SHA1 SHA512 TLSH
            Submit Download