General
-
Target
z3hir.arm7.elf
-
Size
52KB
-
Sample
230501-lty9asgh8x
-
MD5
0b01a77e5cbd3e573c68ebbeea78c613
-
SHA1
a051da0fb9a61ec5cff51cf4aee2fd2fc5c24b22
-
SHA256
00ed53cef3499c5947e3b387dee128fa87927e9ed87d997ab1cb2e4ee5b9aa69
-
SHA512
d4767b2ee3b878c64293c177ed97e3b81ebd5a476bdf707be628dd962138328dc1c81bc2cfff11207c3d8a5342ebd4b11e7d7703132aac5fee5e6440ebe855b4
-
SSDEEP
1536:bOIlMtSFSIhqUXKpdhi41Hf/ZVxLv8WHE:bOmMoBlapbief/ZrLFE
Malware Config
Extracted
mirai
UNST
Targets
-
-
Target
z3hir.arm7.elf
-
Size
52KB
-
MD5
0b01a77e5cbd3e573c68ebbeea78c613
-
SHA1
a051da0fb9a61ec5cff51cf4aee2fd2fc5c24b22
-
SHA256
00ed53cef3499c5947e3b387dee128fa87927e9ed87d997ab1cb2e4ee5b9aa69
-
SHA512
d4767b2ee3b878c64293c177ed97e3b81ebd5a476bdf707be628dd962138328dc1c81bc2cfff11207c3d8a5342ebd4b11e7d7703132aac5fee5e6440ebe855b4
-
SSDEEP
1536:bOIlMtSFSIhqUXKpdhi41Hf/ZVxLv8WHE:bOmMoBlapbief/ZrLFE
-
Contacts a large (18942) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Modifies the Watchdog daemon
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Reads system network configuration
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information
Reads data from /proc virtual filesystem.
-