Analysis
-
max time kernel
152s -
max time network
155s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20230831-en -
resource tags
-
submitted
12/10/2023, 17:25
General
-
Target
MiraiVariant.x86
-
Size
28KB
-
MD5
f98f9388498dc45728358d1c26d5f790
-
SHA1
e6aa17b383db788e37e2de9e9c93331f9378f915
-
SHA256
bd99fe47b4e957a31d67debd57566bb7d09aacfed25356e202671b3ff5793100
-
SHA512
cc38235494f289b0dcbdd21ad71423657570185b648b409823b52ac021d1ef5d7257a2385fbb53aa107df899417c761a38fe90d5921910d6a231257dbbcbb0f9
-
SSDEEP
768:RCG/rJv+tqC3Y+B4Jm9Go3ZXelv3YmFAtM5inRTrF9:YGtv+tzMJm9GuUvhFzo39
Malware Config
Extracted
mirai
MIRAI
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Contacts a large (20159) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/MiraiVariant.x86/tmp/MiraiVariant.x861⤵