Overview

overview

10

Static

static

7

9e32ed8c94...0c.elf

debian-9-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9e32ed8c9403be4cf22c1dee53c7da0c.elf

  • Size

    32KB

  • Sample

    230529-tt9c9scf78

  • MD5

    9e32ed8c9403be4cf22c1dee53c7da0c

  • SHA1

    91c086a6a71453600d1b3b894b4158a0377b6af1

  • SHA256

    4fb4e918a266f4ecc087f64f3d4ac04303f02ae5e57d49f037710c502ff07acf

  • SHA512

    6ca48b910cf61a2b97e60160fbdf60f0dc7152a461db1b2bd82dc6aaff076ecefbba507d5fa732fb690d05ca6482fddd0a590663887151941c2ff38faf0674d7

  • SSDEEP

    768:GdI28u3wKNzyHtNc+9BT447b4AcAOjSSP624PSqgWMz3:qx8CNWH8eBTzaAaSSCCx3

Score
10/10
miraibotnetdiscoveryupx

Malware Config

Targets

    • Target

      9e32ed8c9403be4cf22c1dee53c7da0c.elf

    • Size

      32KB

    • MD5

      9e32ed8c9403be4cf22c1dee53c7da0c

    • SHA1

      91c086a6a71453600d1b3b894b4158a0377b6af1

    • SHA256

      4fb4e918a266f4ecc087f64f3d4ac04303f02ae5e57d49f037710c502ff07acf

    • SHA512

      6ca48b910cf61a2b97e60160fbdf60f0dc7152a461db1b2bd82dc6aaff076ecefbba507d5fa732fb690d05ca6482fddd0a590663887151941c2ff38faf0674d7

    • SSDEEP

      768:GdI28u3wKNzyHtNc+9BT447b4AcAOjSSP624PSqgWMz3:qx8CNWH8eBTzaAaSSCCx3

    Score
    10/10
    miraibotnetdiscovery

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Contacts a large (247076) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Changes its process name

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks