General

  • Target

    krf_unpack

  • Size

    161KB

  • MD5

    1cbc1ae6e6486c0ec9c60c822ece8084

  • SHA1

    645147bd9103d0200ca91eace8efea0d2c322856

  • SHA256

    379bb7bbd48de251e2019d4e0c9e48edcde603c99fa28a7bc57a721715d56af3

  • SHA512

    ae2ef01a126f64b695a2dada45a62599819cb764593dff03e64395aa35eb1b2ba4642731c79bd550a5811849b94a31997c7f9f8f835c5fa3a048e09bb0b44ad4

  • SSDEEP

    3072:X2HIzXUhvWTkgibI1HB6RCioXkJ4n4465mPB45zErrZhM0Hz:X2HcDJibIuTVJS4465mPB45zEnZhM0Hz

Malware Config

Signatures

  • Detect Mirai Payload 1 IoCs
  • Detected Gafgyt Variant 1 IoCs
  • Detected x86corona Mirai Variant 1 IoCs

    File resembles variant of the Mirai bot which was first seen in early 2020.

  • Gafgyt family
  • Mirai family
  • Mirai_x86corona family

Files

  • krf_unpack
    .elf linux x86