Overview

overview

10

Static

static

7

f78a83d756...de.elf

ubuntu-18.04-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f78a83d756084712a6b6df1aeca10ade.elf

  • Size

    23KB

  • Sample

    230503-tfmmcahb5x

  • MD5

    f78a83d756084712a6b6df1aeca10ade

  • SHA1

    9e6842be6daf2fe2a765ba0ce026b5f95a54ee90

  • SHA256

    e99b8f5f1732bc27ba3e043cb55a561a286135f3d544e69042c4e89658977d6e

  • SHA512

    75c7611e450520e6111d8a476512aea554408cc412cea353305d097253096bd5bfa5f938da25ba350d2fe9059132b384cc31a2c3b0282634d7a4a3d9ce6a14b8

  • SSDEEP

    384:M0XjEy4VsCu/nFZ84Yg84t8/ejhp27rKLc6lUCbgxKMWl0iouN07JoWHt3UhLv1H:R+VsCIFZeZ4t8/ejf42lULxKMxiuoz5

Score
10/10
miraibotnetbotnetdiscoverylinuxupx

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

C2

cnc.kintaro.cc

Targets

    • Target

      f78a83d756084712a6b6df1aeca10ade.elf

    • Size

      23KB

    • MD5

      f78a83d756084712a6b6df1aeca10ade

    • SHA1

      9e6842be6daf2fe2a765ba0ce026b5f95a54ee90

    • SHA256

      e99b8f5f1732bc27ba3e043cb55a561a286135f3d544e69042c4e89658977d6e

    • SHA512

      75c7611e450520e6111d8a476512aea554408cc412cea353305d097253096bd5bfa5f938da25ba350d2fe9059132b384cc31a2c3b0282634d7a4a3d9ce6a14b8

    • SSDEEP

      384:M0XjEy4VsCu/nFZ84Yg84t8/ejhp27rKLc6lUCbgxKMWl0iouN07JoWHt3UhLv1H:R+VsCIFZeZ4t8/ejf42lULxKMxiuoz5

    Score
    10/10
    miraibotnetbotnetdiscovery

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Contacts a large (105452) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Changes its process name

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Network Service Scanning

2
T1046

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks