mirai | 66dccdec81b69c25ccfa292d8281a9715a640e45ae0989502190fbcbdcc19658 | Triage

Sharing

General

Target

botx.x86.elf
Size

50KB
Sample

230619-jx87kadg2t
MD5

a147fd7f6b23285ef215a05d5f3884e4
SHA1

183e6f5d2dd9a95c8ba214f1f81134297fffb494
SHA256

66dccdec81b69c25ccfa292d8281a9715a640e45ae0989502190fbcbdcc19658
SHA512

8d64e25eca6b9e3163958623678b94f1c78610eb41c85d85029b6241265ce1ec87d67397cfb618d7ccab5c7ea42fca9730a6608771eaa05e7427662e0221ac0a
SSDEEP

768:ytYRSjaQ9DaZ/oJlExakbMqu8iuIkvKy+h1laTm/4RsvKQLDJCgMjz:WYRSjaCu1wlPGIly+hXaq/4G3LNCgMv

Score

10^/10

mirai condi discovery linux

Malware Config

Extracted

Family

mirai

Botnet

CONDI

C2

cnc.nullz.tk

report.nullz.tk

Targets

- Target
  
  botx.x86.elf
- Size
  
  50KB
- MD5
  
  a147fd7f6b23285ef215a05d5f3884e4
- SHA1
  
  183e6f5d2dd9a95c8ba214f1f81134297fffb494
- SHA256
  
  66dccdec81b69c25ccfa292d8281a9715a640e45ae0989502190fbcbdcc19658
- SHA512
  
  8d64e25eca6b9e3163958623678b94f1c78610eb41c85d85029b6241265ce1ec87d67397cfb618d7ccab5c7ea42fca9730a6608771eaa05e7427662e0221ac0a
- SSDEEP
  
  768:ytYRSjaQ9DaZ/oJlExakbMqu8iuIkvKy+h1laTm/4RsvKQLDJCgMjz:WYRSjaCu1wlPGIly+hXaq/4G3LNCgMv
Score

9^/10

discovery
- Contacts a large (57949) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Changes its process name
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Impair Defenses

Hijack Execution Flow

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1