mirai | 0361a1a77cef36cea5fee27905b39ceeac0ec0812c8eb36f9a6771ced6aad7e5 | Triage

Sharing

General

Target

botx.x86.elf
Size

50KB
Sample

230823-tf7mhsfb4z
MD5

9065978aa0252f7e70aaecd616602d12
SHA1

e11a21dff0e6332fcde2303d8d98b835e2b79ea9
SHA256

0361a1a77cef36cea5fee27905b39ceeac0ec0812c8eb36f9a6771ced6aad7e5
SHA512

35b375ba43b81cdda9a319bfa4653a3f239f22caf61f309b7e15dbb4e144bf3296abaf848610c38e4dee65c055f6f71d3b1852a6218f1e63c1040f382ef1af12
SSDEEP

768:ytYRSjaQ9DaZ/oJNExakbMqu8iMlkvKy+h9lCTm/4RsvKQLDJIgMjz:WYRSjaCu1wNPElly+hPCq/4G3LNIgMv

Score

10^/10

mirai condi discovery linux

Malware Config

Extracted

Family

mirai

Botnet

CONDI

C2

cnc.condinet.cf

report.condinet.cf

Targets

- Target
  
  botx.x86.elf
- Size
  
  50KB
- MD5
  
  9065978aa0252f7e70aaecd616602d12
- SHA1
  
  e11a21dff0e6332fcde2303d8d98b835e2b79ea9
- SHA256
  
  0361a1a77cef36cea5fee27905b39ceeac0ec0812c8eb36f9a6771ced6aad7e5
- SHA512
  
  35b375ba43b81cdda9a319bfa4653a3f239f22caf61f309b7e15dbb4e144bf3296abaf848610c38e4dee65c055f6f71d3b1852a6218f1e63c1040f382ef1af12
- SSDEEP
  
  768:ytYRSjaQ9DaZ/oJNExakbMqu8iMlkvKy+h9lCTm/4RsvKQLDJIgMjz:WYRSjaCu1wNPElly+hPCq/4G3LNIgMv
Score

9^/10

discovery
- Contacts a large (56813) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Changes its process name
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Impair Defenses

Hijack Execution Flow

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1