Overview

overview

10

Static

static

7

SecuriteIn...59.elf

debian-9-mips

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Linux.Siggen.9999.11120.22659.elf

  • Size

    29KB

  • Sample

    230430-dzrgmsfb3x

  • MD5

    35379ab8e8ebaa656db7575d1f9eb976

  • SHA1

    1ccc7718504aaa19c0663222ebdc60f67be1f29e

  • SHA256

    f4e48e33d6ba090c6b61ef9ca3460f244be8dc3d36c55e0d83916925f5e00724

  • SHA512

    f0c903a661a403501b91aa1ca6e76c2cca01778a361c60eb3421eda4ef45b5337a0667f3780a4dd3e604382ac14bfec8bc3215273bf5846d4e9e6e79241ef70d

  • SSDEEP

    768:cNwtIOp5dCdu+wqxMl2CdTP4L5lcTCiVcJgGlzDpbuR1Jp:cNwtN/qu+txMlNTMTcTCi6VJuf

Score
10/10
miraiunstbotnetdiscoveryupx

Malware Config

Extracted

Family

mirai

Botnet

UNST

Targets

    • Target

      SecuriteInfo.com.Linux.Siggen.9999.11120.22659.elf

    • Size

      29KB

    • MD5

      35379ab8e8ebaa656db7575d1f9eb976

    • SHA1

      1ccc7718504aaa19c0663222ebdc60f67be1f29e

    • SHA256

      f4e48e33d6ba090c6b61ef9ca3460f244be8dc3d36c55e0d83916925f5e00724

    • SHA512

      f0c903a661a403501b91aa1ca6e76c2cca01778a361c60eb3421eda4ef45b5337a0667f3780a4dd3e604382ac14bfec8bc3215273bf5846d4e9e6e79241ef70d

    • SSDEEP

      768:cNwtIOp5dCdu+wqxMl2CdTP4L5lcTCiVcJgGlzDpbuR1Jp:cNwtN/qu+txMlNTMTcTCi6VJuf

    Score
    10/10
    miraiunstbotnetdiscovery

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Contacts a large (65267) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks