mirai | 08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0

Analysis

max time kernel
149s
max time network
5s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/09/2026, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
Size 23KB
Sample260922-nl142avbqa
SHA256 08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0
MD5 e445c4b25713369d924c8da5a874e8d1
SHA1 0fec1c35be2fa043dc6ed878ec91d8d10ffaa5d6
SHA512 2bf2dba93ac7e2db722394a524fe3ab15e2e719c54db7e4f3a3cedde0628caf5351fa738f61fd5c33f42d23a9256a255eb4586b1be9dc8c68b7d7b8a2c5bed97
SSDEEP 384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiFlH1QfmdtJgGlzDpH7uND:YeD8ZSWvZHZbs1row697qohQvg9FlH1C
TLSH
T1A3B2DF3C2B111A58DE0EC0BD839D1B613CB41B359182AD4B6207EDD7AF964B47453BE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet lzrd defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

Botnet

LZRD

172.105.96.226

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for modification	/dev/misc/watchdog	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/bin/watchdog	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for modification	/sbin/watchdog	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin

Reads runtime system information 22 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/703/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/777/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/795/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/655/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/658/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/694/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/707/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/714/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/742/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/796/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/662/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/702/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/710/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/765/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/769/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/674/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/696/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/743/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/772/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/773/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/661/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
File opened for reading	/proc/701/cmdline	jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin

/tmp/jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
/tmp/jaffacakes118_08a81ab910fed1548cd34cffafe24f72b92a0e0a52041eb6804712a7efb203b0.bin
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:706

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads