mirai | 0c082bbcf7f3189477db4f2ffac1e89ecb154ccd03774fa77c6eecfd0c927bd9 | Triage

Sharing

General

Target

SecuriteInfo.com.Heur.20230430233121085673530.elf
Size

44KB
Sample

230430-3nvglabh4x
MD5

ba9442a57c2bd1a80699cc3f2f521f1f
SHA1

0ce2f95e2c7efd238c6c09e1695f16f60880ea06
SHA256

0c082bbcf7f3189477db4f2ffac1e89ecb154ccd03774fa77c6eecfd0c927bd9
SHA512

b9e32671317453649b5de5fbd64337c06ba4469ca7e053ec4ff3b305417bd9fe170af44ccf642e99c0ca2f0c3c9938c9a90e41f613d6cd8abc86ed6409d97a7b
SSDEEP

768:H9cpVPp0msNbXuqmSjHvvS2+1ivSzhGlie5YQwtSiNDCYImTxV/D4NJgGlzDpbuN:HM1KiqmSjHvvS2JccsAU91PxJD4nVJuN

Score

10^/10

mirai kyton botnet discovery upx

Malware Config

Extracted

Family

mirai

Botnet

KYTON

Targets

- Target
  
  SecuriteInfo.com.Heur.20230430233121085673530.elf
- Size
  
  44KB
- MD5
  
  ba9442a57c2bd1a80699cc3f2f521f1f
- SHA1
  
  0ce2f95e2c7efd238c6c09e1695f16f60880ea06
- SHA256
  
  0c082bbcf7f3189477db4f2ffac1e89ecb154ccd03774fa77c6eecfd0c927bd9
- SHA512
  
  b9e32671317453649b5de5fbd64337c06ba4469ca7e053ec4ff3b305417bd9fe170af44ccf642e99c0ca2f0c3c9938c9a90e41f613d6cd8abc86ed6409d97a7b
- SSDEEP
  
  768:H9cpVPp0msNbXuqmSjHvvS2+1ivSzhGlie5YQwtSiNDCYImTxV/D4NJgGlzDpbuN:HM1KiqmSjHvvS2JccsAU91PxJD4nVJuN
Score

10^/10

mirai kyton botnet discovery
- Mirai
  Mirai is a prevalent Linux malware infecting exposed network devices.
  botnet mirai
- Contacts a large (112173) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies the Watchdog daemon
  Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
- Changes its process name
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
- Reads runtime system information
  Reads data from /proc virtual filesystem.
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Impair Defenses

Credential Access

Discovery

Network Service Scanning

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

miraikytonbotnetdiscovery