Overview

overview

10

Static

static

7

nag.mpsl

debian-9-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    nag.mpsl

  • Size

    34KB

  • Sample

    230429-1776paec6s

  • MD5

    ce711144616b2d1038c9295fa6983f6b

  • SHA1

    2517ed7a6d9802ca9ddcae6ee7f52b08b89b5eae

  • SHA256

    14770cf045fc9861c065bedd807f03c552bd11de39e4253e0ef42fbf671ebf11

  • SHA512

    b042938638a22ce8567b17e7fddaabc7e8a6f0fd6ebd64acab9f253bc9df7a3e397a6458f4d9d8bd7df633bec471d9d343d054dac36f1bc11bb0d9db4706fe2e

  • SSDEEP

    768:mj9xqRjKJh1bXWJ1fflDYeO4yDHFx7+0kwzaEicYwiBJmUKOWG:y6RGxyJJflDYeR0b+T2aEDv0

Score
10/10
miraibotnetdiscoveryupx

Malware Config

Targets

    • Target

      nag.mpsl

    • Size

      34KB

    • MD5

      ce711144616b2d1038c9295fa6983f6b

    • SHA1

      2517ed7a6d9802ca9ddcae6ee7f52b08b89b5eae

    • SHA256

      14770cf045fc9861c065bedd807f03c552bd11de39e4253e0ef42fbf671ebf11

    • SHA512

      b042938638a22ce8567b17e7fddaabc7e8a6f0fd6ebd64acab9f253bc9df7a3e397a6458f4d9d8bd7df633bec471d9d343d054dac36f1bc11bb0d9db4706fe2e

    • SSDEEP

      768:mj9xqRjKJh1bXWJ1fflDYeO4yDHFx7+0kwzaEicYwiBJmUKOWG:y6RGxyJJflDYeR0b+T2aEDv0

    Score
    10/10
    miraibotnetdiscovery

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Contacts a large (36792) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Changes its process name

    • Deletes itself

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Network Service Scanning

2
T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks