Overview

overview

10

Static

static

7

4beb12afef...82.elf

ubuntu-18.04-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a0035af8d827c209a89cea5ae60d5110.bin

  • Size

    33KB

  • Sample

    230502-cckj5sbc2t

  • MD5

    689d4d88e3f84e6998f67b5de85e269c

  • SHA1

    bdc99f4e81dc09824d6b30dc9955abe0ce5e5b05

  • SHA256

    d7ef7d5db7f467e62f465683a03e08fb898383e567eadcf7732ca11ca661b65b

  • SHA512

    8c7a666bd4105721d18059f3e6c2d2fe4f61ed7a44ca93da7712329557bf1fb195fcc6f49ba9e0e907a843a5691993f2af5889731f3e2111fcc7be79d4f7c3e4

  • SSDEEP

    768:miwdshGXKQ41Xykye1xHliqlNUuHB+qrrk0J8Rjz3Dwj3:DwQGH4crORliqdPr4lpw

Score
10/10
miraikytonbotnetdiscoverylinuxupx

Malware Config

Extracted

Family

mirai

Botnet

KYTON

Targets

    • Target

      4beb12afef07d5bbe0049879a09a72309e63f75cf8f3d11bb9f092f7c56b0982.elf

    • Size

      34KB

    • MD5

      a0035af8d827c209a89cea5ae60d5110

    • SHA1

      a25665b7268adcca0619acff19055053da6c64f0

    • SHA256

      4beb12afef07d5bbe0049879a09a72309e63f75cf8f3d11bb9f092f7c56b0982

    • SHA512

      5f773ac1679ece6d45848891f4a0d306a65ea1957f3bee0475a84e0eadf32f480c7975ce3a6ee953aaedc8e9430975517a1f007006316a4a8254eb179a72b9d6

    • SSDEEP

      768:dDHUts8wX6+D1UCjLVyghoa0m5Budg8OGbn5/QenbcuyD7UGQRjF:d4uCW1J3ogaCuOoz9Qenouy8Gy5

    Score
    10/10
    miraikytonbotnetdiscovery

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Contacts a large (103370) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Changes its process name

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Credential Access

Discovery

Network Service Scanning

2
T1046

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks