Overview

overview

10

Static

static

7

4fb4e918a2...cf.elf

debian-9-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9e32ed8c9403be4cf22c1dee53c7da0c.bin

  • Size

    31KB

  • Sample

    230531-b48wdacg7s

  • MD5

    6a57fea688fef5b0171498eb9d15d04f

  • SHA1

    6e20e2ebbf83eea98dbfcf21a802bce1ae1ecde6

  • SHA256

    a51cd8a228010d5d5e39d4e981b2b6717224fb5c7be7440eb6be3c2bd7196d1f

  • SHA512

    4842ef8dd244c9b7ecccc878bd3feea864ad9e996e63dbe7cc7c94100b0041a5d18f6ca64e14582938359295b5f626562989ec3f48bca650630b67a24e3dec20

  • SSDEEP

    768:YO6jAK9qQqd6H6BDtF+X2DdAY37vocdgXX:YO6jAMU6aBpcX2ZAY3jFdgXX

Score
10/10
miraibotnetdiscoveryupx

Malware Config

Targets

    • Target

      4fb4e918a266f4ecc087f64f3d4ac04303f02ae5e57d49f037710c502ff07acf.elf

    • Size

      32KB

    • MD5

      9e32ed8c9403be4cf22c1dee53c7da0c

    • SHA1

      91c086a6a71453600d1b3b894b4158a0377b6af1

    • SHA256

      4fb4e918a266f4ecc087f64f3d4ac04303f02ae5e57d49f037710c502ff07acf

    • SHA512

      6ca48b910cf61a2b97e60160fbdf60f0dc7152a461db1b2bd82dc6aaff076ecefbba507d5fa732fb690d05ca6482fddd0a590663887151941c2ff38faf0674d7

    • SSDEEP

      768:GdI28u3wKNzyHtNc+9BT447b4AcAOjSSP624PSqgWMz3:qx8CNWH8eBTzaAaSSCCx3

    Score
    10/10
    miraibotnetdiscovery

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Contacts a large (195337) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Changes its process name

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Network Service Scanning

2
T1046

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks