Overview

overview

10

Static

static

7

16192a6828...5614cd

debian-9-armhf

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    16192a6828b8211b62a59206a05614cd

  • Size

    53KB

  • Sample

    231219-2hwa9sdbd8

  • MD5

    16192a6828b8211b62a59206a05614cd

  • SHA1

    13220da21f0c72846c100f468ce8fe8052b2f31c

  • SHA256

    2ea10f88b82e8f5e530324ecaeb2bf4339ac0ad420b9104df91a8fe5f4f86552

  • SHA512

    199a339617077fbba6372889a650f2f97876e17b67882bbc9482e932e1e4c7550d845f807267c416ca30b607da769607c5d3580e5730165690a85198fc9e4a84

  • SSDEEP

    1536:aL61ZKq7Z4ZrRKKcyz0pTAyKUByPKlgOf/:51ZPwuy4TDvSC

Score
10/10
miraibotnetdiscoveryupx

Malware Config

Targets

    • Target

      16192a6828b8211b62a59206a05614cd

    • Size

      53KB

    • MD5

      16192a6828b8211b62a59206a05614cd

    • SHA1

      13220da21f0c72846c100f468ce8fe8052b2f31c

    • SHA256

      2ea10f88b82e8f5e530324ecaeb2bf4339ac0ad420b9104df91a8fe5f4f86552

    • SHA512

      199a339617077fbba6372889a650f2f97876e17b67882bbc9482e932e1e4c7550d845f807267c416ca30b607da769607c5d3580e5730165690a85198fc9e4a84

    • SSDEEP

      1536:aL61ZKq7Z4ZrRKKcyz0pTAyKUByPKlgOf/:51ZPwuy4TDvSC

    Score
    10/10
    miraibotnetdiscovery

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Contacts a large (20031) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks