mirai | 4e72862eeeba2634ee516312c0e7b21c8ffe7b62c8fb4e8512c8969d7288827b

General

Target
net.mpsl.elf
Size 253KB
Sample261012-t7tvqsyscs
SHA256 4e72862eeeba2634ee516312c0e7b21c8ffe7b62c8fb4e8512c8969d7288827b
MD5 cf0a9166aa9d15155f48680e94cef3c4
SHA1 e7802e7ffa26eee47b0e5da42e9cd3948bf9589a
SHA512 9e034ef0176ae1ace2141facd48c1d2f70c1fd134954da06b60d4903d50e9c017baa4c06dcec240222846d99351ff84fa2d9976f9da1abc25f2a047b4a3d5511
SSDEEP 3072:IEPRLaqvbCjlXnjoi7K7BZql52hj080FSq1W/qnr3aeKU:dPRGwUXjyql52p0Cq1Wq2el
TLSH
T18A44D50AAF610FBBD8AFDD3706E90B0529CC651722A83F757974D918F50A64B0AD3C78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet credential_access defense_evasion discovery execution mirai persistence privilege_escalation

Malware Config

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
810	sh
813	chmod

Deletes itself 1 IoCs

pid	Process
802	net.mpsl.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	net.mpsl.elf
File opened for modification	/dev/misc/watchdog	net.mpsl.elf

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/netupd	net.mpsl.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/sys_daemon	net.mpsl.elf

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/netd.service	net.mpsl.elf

Reads process memory 1 TTPs 33 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/26/maps	net.mpsl.elf
File opened for reading	/proc/3/maps	net.mpsl.elf
File opened for reading	/proc/6/maps	net.mpsl.elf
File opened for reading	/proc/13/maps	net.mpsl.elf
File opened for reading	/proc/21/maps	net.mpsl.elf
File opened for reading	/proc/31/maps	net.mpsl.elf
File opened for reading	/proc/1/maps	net.mpsl.elf
File opened for reading	/proc/9/maps	net.mpsl.elf
File opened for reading	/proc/22/maps	net.mpsl.elf
File opened for reading	/proc/28/maps	net.mpsl.elf
File opened for reading	/proc/7/maps	net.mpsl.elf
File opened for reading	/proc/12/maps	net.mpsl.elf
File opened for reading	/proc/16/maps	net.mpsl.elf
File opened for reading	/proc/8/maps	net.mpsl.elf
File opened for reading	/proc/24/maps	net.mpsl.elf
File opened for reading	/proc/25/maps	net.mpsl.elf
File opened for reading	/proc/4/maps	net.mpsl.elf
File opened for reading	/proc/5/maps	net.mpsl.elf
File opened for reading	/proc/17/maps	net.mpsl.elf
File opened for reading	/proc/19/maps	net.mpsl.elf
File opened for reading	/proc/2/maps	net.mpsl.elf
File opened for reading	/proc/18/maps	net.mpsl.elf
File opened for reading	/proc/20/maps	net.mpsl.elf
File opened for reading	/proc/30/maps	net.mpsl.elf
File opened for reading	/proc/15/maps	net.mpsl.elf
File opened for reading	/proc/29/maps	net.mpsl.elf
File opened for reading	/proc/32/maps	net.mpsl.elf
File opened for reading	/proc/10/maps	net.mpsl.elf
File opened for reading	/proc/11/maps	net.mpsl.elf
File opened for reading	/proc/14/maps	net.mpsl.elf
File opened for reading	/proc/23/maps	net.mpsl.elf
File opened for reading	/proc/27/maps	net.mpsl.elf
File opened for reading	/proc/33/maps	net.mpsl.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	802	net.mpsl.elf

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	net.mpsl.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/maps	net.mpsl.elf

/tmp/net.mpsl.elf
/tmp/net.mpsl.elf
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Modifies init.d
- Modifies systemd
- Reads process memory
- Changes its process name
- Reads runtime system information
PID:802
- /bin/sh
  sh -c "chmod +x /var/tmp/.sys_recovery.sh"
  2⤵
  - File and Directory Permissions Modification
  PID:810
- - /usr/bin/chmod
    chmod +x /var/tmp/.sys_recovery.sh
    3⤵
    - File and Directory Permissions Modification
    PID:813
- /bin/sh
  sh -c "systemctl disable .networkd.service 2>/dev/null"
  2⤵
  PID:816
- - /usr/bin/systemctl
    systemctl disable .networkd.service
    3⤵
    - Reads runtime system information
    PID:818
- /bin/sh
  sh -c "update-rc.d sys_daemon defaults 2>/dev/null"
  2⤵
  PID:830
- - /usr/sbin/update-rc.d
    update-rc.d sys_daemon defaults
    3⤵
    PID:832
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:842
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:842
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:842
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads runtime system information
      PID:842
- /bin/sh
  sh -c "chkconfig --add sys_daemon 2>/dev/null"
  2⤵
  PID:865
- /bin/sh
  sh -c "systemctl daemon-reload 2>/dev/null"
  2⤵
  PID:866
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads runtime system information
    PID:867
- /bin/sh
  sh -c "systemctl enable netd.service 2>/dev/null"
  2⤵
  PID:883
- - /usr/bin/systemctl
    systemctl enable netd.service
    3⤵
    - Reads runtime system information
    PID:886
- /bin/sh
  sh -c "systemctl start netd.service 2>/dev/null"
  2⤵
  PID:902
- - /usr/bin/systemctl
    systemctl start netd.service
    3⤵
    - Reads runtime system information
    PID:903

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Persistence

Boot or Logon Autostart Execution

2

T1547

XDG Autostart Entries

1

T1547.013

Boot or Logon Initialization Scripts

1

T1037

RC Scripts

1

T1037.004

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

XDG Autostart Entries

1

T1547.013

Boot or Logon Initialization Scripts

1

T1037

RC Scripts

1

T1037.004

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

Impair Defenses

Credential Access

OS Credential Dumping

1

T1003

Proc Filesystem

1

T1003.007

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

netupd

Path /etc/cron.d/netupd
Size 49B
SHA256 6f50f3c70491721be9a36ce4fd3cfcac66dba6fe7b3af969b9aae67b71bc2435
MD5 4ed2963e9d81315709b84dfe14f74fd0
SHA1 3b33da5d9f8c5a091ce3183e85cc9f1b4017a566
SHA512 15382aec41e41c09d96199fd83caf84ee475bc6442bef7e608952fd188ec5b871d90a4438287f9be39a676cc9c01141fa43890d43d150f0948e6bcab67569789
MD5 SHA1 SHA512

Submit Download

sys_daemon

Path /etc/init.d/sys_daemon
Size 282B
SHA256 c277627bfbdac903b0229ad7417771294a3135aa01cc6300cd7b0df09f54cc97
MD5 e6a107234365ee6b813c8dc0030a570a
SHA1 f94968be4439fafb09cadee7a8e3cc1d546eebcc
SHA512 02d0f12a9b4a9754403b4f444a2061db802bcc5f5af1ca474f4f508fbe933f4e560023ebc103e8a7d61bac53de3e2aa147b56b2e88f8c2efd79008d02cf6035c
TLSH
T126D09E45F44585B52ECA4179A71DB25975C10057C4253412FF6E3BF2DF55392606A1B0
MD5 SHA1 SHA512 TLSH

Submit Download

netd.service

Path /etc/systemd/system/netd.service
Size 241B
SHA256 cee909cdcda744de562e43a98c9d5d6ef26f2ebe194bee98696043274de026a8
MD5 3c94a0f2e307c750f3ece842fa65575b
SHA1 fdcc673dd4a6e7be66f63f9ac1d1d5c134366aaa
SHA512 7de8c2cc91284aa1ecf6ea4c3c05f76c82df7790077720bad5bb43950a24f34ecf5a8e4046b6979503fca647788fd8db7a58ec81dfd1e12125036d785c51bb8a
TLSH
T150D09712363424E9D8CF1172CF796F808F000080888F2331CBF0AFA28AE268691264BE
MD5 SHA1 SHA512 TLSH

Submit Download

.KXjSUwaA

Path /var/tmp/.KXjSUwaA
Size 253KB
SHA256 4e72862eeeba2634ee516312c0e7b21c8ffe7b62c8fb4e8512c8969d7288827b
MD5 cf0a9166aa9d15155f48680e94cef3c4
SHA1 e7802e7ffa26eee47b0e5da42e9cd3948bf9589a
SHA512 9e034ef0176ae1ace2141facd48c1d2f70c1fd134954da06b60d4903d50e9c017baa4c06dcec240222846d99351ff84fa2d9976f9da1abc25f2a047b4a3d5511
SSDEEP 3072:IEPRLaqvbCjlXnjoi7K7BZql52hj080FSq1W/qnr3aeKU:dPRGwUXjyql52p0Cq1Wq2el
TLSH
T18A44D50AAF610FBBD8AFDD3706E90B0529CC651722A83F757974D918F50A64B0AD3C78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.sys_recovery.sh

Path /var/tmp/.sys_recovery.sh
Size 149B
SHA256 4b7d048897bee63e3200c23b42d6a933988e7cdeb79b5b37ba2e4f657ffd69cf
MD5 d6f25042019a0a77e1240aae0448830a
SHA1 43b883bccd027aed7fbaa16cb2960fc35b1929b3
SHA512 d9cca36391acd9a49add78390537291c927594fc49a607f62f69d9ddb72706f1d137da4156d4d5d22f1b2782798aa732299876d9a9e00e29d34adad467fb0c75
TLSH
T1FAC08C03F1500C6939A602B898BC102011C29137481E95A0B00E35323F14348A572325
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads