mirai | 418ffc60d83fb2b4633bf478e0b894d070f02037a635e5288897cbe636f52db2 | Triage

Sharing

General

Target

1357c9b4e6e780cd2e2feb8cf330c5b5
Size

57KB
Sample

231219-2gstracfg8
MD5

1357c9b4e6e780cd2e2feb8cf330c5b5
SHA1

63b4aecba50c635534c34a56412ab9ea721f70f5
SHA256

418ffc60d83fb2b4633bf478e0b894d070f02037a635e5288897cbe636f52db2
SHA512

a7b568c78c96f535d199e8d426252bd117a2b500ab4e438b9c6304b1068bfc40828bf852f6167b5f9c2d429c1202e3fee13c4d50de6653c22267171429aa0b92
SSDEEP

768:x8vnlClB7npfad/tI4kmOGOmM8TaBere2SesbL3WFXiJ4u6mBqR:x8vn8evwGPSfbLGU6lR

Score

10^/10

mirai discovery

Malware Config

Targets

- Target
  
  1357c9b4e6e780cd2e2feb8cf330c5b5
- Size
  
  57KB
- MD5
  
  1357c9b4e6e780cd2e2feb8cf330c5b5
- SHA1
  
  63b4aecba50c635534c34a56412ab9ea721f70f5
- SHA256
  
  418ffc60d83fb2b4633bf478e0b894d070f02037a635e5288897cbe636f52db2
- SHA512
  
  a7b568c78c96f535d199e8d426252bd117a2b500ab4e438b9c6304b1068bfc40828bf852f6167b5f9c2d429c1202e3fee13c4d50de6653c22267171429aa0b92
- SSDEEP
  
  768:x8vnlClB7npfad/tI4kmOGOmM8TaBere2SesbL3WFXiJ4u6mBqR:x8vn8evwGPSfbLGU6lR
Score

9^/10

discovery
- Contacts a large (112841) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Changes its process name
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Impair Defenses

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1