mirai | 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a

Analysis

max time kernel
0s
max time network
34s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
11/11/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf
Size 30KB
Sample261111-mtfydsfs2j
SHA256 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a
MD5 98dcdc9edc2835cb1835a04c7daf40ab
SHA1 dc3194021bbdc98e51df038dff1cd11086c143b8
SHA512 47086c7d971efb25f5023d074fd8c442b0a15266a74ff6b3286e658955dbcf5fc50ca4d6fcedab001521a861e6a0d3f562a6383c637fe8e49a8bc93bd98d1f0b
SSDEEP 768:JWCmB43AjaM4KN3j9kx7KurQTaJgGlzDpbuR1JO:JTp3uaM4KVuUKVJug
TLSH
T116D2D08846011E9ADDB38179A35507547C670B436083EFF9A0ADF94F8E8D6E92493E98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet lzrd defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

Botnet

LZRD

94.26.106.200

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf
File opened for modification	/dev/misc/watchdog	0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf

/tmp/0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf
/tmp/0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf
1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
PID:724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads