Overview

overview

10

Static

static

7

x86.elf

ubuntu-18.04-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    x86.elf

  • Size

    34KB

  • Sample

    230430-ztbd5aba92

  • MD5

    a0035af8d827c209a89cea5ae60d5110

  • SHA1

    a25665b7268adcca0619acff19055053da6c64f0

  • SHA256

    4beb12afef07d5bbe0049879a09a72309e63f75cf8f3d11bb9f092f7c56b0982

  • SHA512

    5f773ac1679ece6d45848891f4a0d306a65ea1957f3bee0475a84e0eadf32f480c7975ce3a6ee953aaedc8e9430975517a1f007006316a4a8254eb179a72b9d6

  • SSDEEP

    768:dDHUts8wX6+D1UCjLVyghoa0m5Budg8OGbn5/QenbcuyD7UGQRjF:d4uCW1J3ogaCuOoz9Qenouy8Gy5

Score
10/10
miraikytonbotnetdiscoverylinuxupx

Malware Config

Extracted

Family

mirai

Botnet

KYTON

Targets

    • Target

      x86.elf

    • Size

      34KB

    • MD5

      a0035af8d827c209a89cea5ae60d5110

    • SHA1

      a25665b7268adcca0619acff19055053da6c64f0

    • SHA256

      4beb12afef07d5bbe0049879a09a72309e63f75cf8f3d11bb9f092f7c56b0982

    • SHA512

      5f773ac1679ece6d45848891f4a0d306a65ea1957f3bee0475a84e0eadf32f480c7975ce3a6ee953aaedc8e9430975517a1f007006316a4a8254eb179a72b9d6

    • SSDEEP

      768:dDHUts8wX6+D1UCjLVyghoa0m5Budg8OGbn5/QenbcuyD7UGQRjF:d4uCW1J3ogaCuOoz9Qenouy8Gy5

    Score
    10/10
    miraikytonbotnetdiscovery

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Contacts a large (103353) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Changes its process name

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Credential Access

Discovery

Network Service Scanning

2
T1046

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks