mirai | 30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae

Analysis

max time kernel
150s
max time network
12s
platform
debian-12_mipsel
resource
debian12-mipsel-20260513-en
resource tags

arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
27/05/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
Size 58KB
Sample260527-wtk2sahs8v
SHA256 30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae
MD5 6175ecc8abbe35ec61549759acb6dbad
SHA1 f412ed64577f94c04711b206816c457e4e880351
SHA512 ef78ee108ea53c56707a4cb25aeee1859a733099c25ccf737151a1f111f01bd2dfb2ea1920a2ccb7c7abbe476a9cc689ed76a6d25ce63b54096c0ebe9d359e16
SSDEEP 1536:tIrRD0gn1aEVi15uooQJpP8LIYUK5xUStCXK5ns:OdUEiOdWF8KK3kas
TLSH
T19043F160FA601AC7CCA98CB4819E35715F1D722536DF87DD6B170A81A31D11FB5A833A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet defense_evasion discovery mirai

Malware Config

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
File opened for modification	/dev/misc/watchdog	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
File opened for modification	/bin/watchdog	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf

Reads runtime system information 13 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/678/cmdline	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
File opened for reading	/proc/698/cmdline	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
File opened for reading	/proc/771/cmdline	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
File opened for reading	/proc/790/cmdline	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
File opened for reading	/proc/791/cmdline	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
File opened for reading	/proc/805/cmdline	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
File opened for reading	/proc/677/cmdline	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
File opened for reading	/proc/704/cmdline	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
File opened for reading	/proc/762/cmdline	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
File opened for reading	/proc/778/cmdline	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
File opened for reading	/proc/810/cmdline	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
File opened for reading	/proc/421/cmdline	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
File opened for reading	/proc/663/cmdline	30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf

/tmp/30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
/tmp/30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae.elf
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads