mirai | 3a93a02024582c6ac415d6d545a357ade4ca4bf338fc579b96fb4fbe0e1afde3

Analysis

max time kernel
149s
max time network
152s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
02/11/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
boatnet.arm7
Size 45KB
Sample261102-pl98datvct
SHA256 3a93a02024582c6ac415d6d545a357ade4ca4bf338fc579b96fb4fbe0e1afde3
MD5 c6b46148143dc537d00ac63affedd4da
SHA1 1e46c931938d4f36ed638dbd9d37a4b7f8d560e9
SHA512 714beb860acb2dfeb95fee9517db80b3e4392e0b843246066e32f991a0ee910d1f76af53e47b5c1601448a4a94142e311b13cb7d4030babb68e7299534525e06
SSDEEP 768:oW2myW5zrY3m+KDOtEQiyy/IOeC2E8IQ0nBu+iGZMHsoJ0yH9q3UELMIk9r/e/ld:X7d5zrY3mVqtoTAIQSu+iGkIyWLMIO/a
TLSH
T16223F10098816770F3E24E31F42AA3D1E6D7CAE5D66470E473F9089DA3660DB4FE29C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet lzrd defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

Botnet

LZRD

5.39.10.241

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Mirai ARM payload 1 IoCs

resource	yara_rule
behavioral1/memory/783-1-0x00008000-0x00026460-memory.dmp	family_mirai_arm

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	boatnet.arm7
File opened for modification	/dev/misc/watchdog	boatnet.arm7

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	boatnet.arm7
File opened for modification	/bin/watchdog	boatnet.arm7

Reads runtime system information 13 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/766/cmdline	boatnet.arm7
File opened for reading	/proc/780/cmdline	boatnet.arm7
File opened for reading	/proc/801/cmdline	boatnet.arm7
File opened for reading	/proc/622/cmdline	boatnet.arm7
File opened for reading	/proc/625/cmdline	boatnet.arm7
File opened for reading	/proc/641/cmdline	boatnet.arm7
File opened for reading	/proc/672/cmdline	boatnet.arm7
File opened for reading	/proc/677/cmdline	boatnet.arm7
File opened for reading	/proc/729/cmdline	boatnet.arm7
File opened for reading	/proc/778/cmdline	boatnet.arm7
File opened for reading	/proc/790/cmdline	boatnet.arm7
File opened for reading	/proc/self/exe	boatnet.arm7
File opened for reading	/proc/640/cmdline	boatnet.arm7

/tmp/boatnet.arm7
/tmp/boatnet.arm7
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:783

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads