mirai | c334d1f171b648837200d244e30b68f17d87b04e5234b401520c9dc29294f960 | Triage

Sharing

General

Target

390c547f2edd449de01a86e3854334d2
Size

26KB
Sample

231219-2x3nwsbah4
MD5

390c547f2edd449de01a86e3854334d2
SHA1

cbc2b3f49c4e4b8333a60943371156e1a04be60a
SHA256

c334d1f171b648837200d244e30b68f17d87b04e5234b401520c9dc29294f960
SHA512

ac249b18cf073915fd85e4c17fea1cbb49cc4d5483d5069a790d4b9d2335f46a26f379dd7d188e103ea000a32ff5253341335831e1b7eed3241c89d9d011c8da
SSDEEP

768:bN1uQZvSz5ft1hMo9PLlbPpWUD2MPwu9Lr3T3:DOz51FLl7pxdP

Score

10^/10

mirai discovery

Malware Config

Targets

- Target
  
  390c547f2edd449de01a86e3854334d2
- Size
  
  26KB
- MD5
  
  390c547f2edd449de01a86e3854334d2
- SHA1
  
  cbc2b3f49c4e4b8333a60943371156e1a04be60a
- SHA256
  
  c334d1f171b648837200d244e30b68f17d87b04e5234b401520c9dc29294f960
- SHA512
  
  ac249b18cf073915fd85e4c17fea1cbb49cc4d5483d5069a790d4b9d2335f46a26f379dd7d188e103ea000a32ff5253341335831e1b7eed3241c89d9d011c8da
- SSDEEP
  
  768:bN1uQZvSz5ft1hMo9PLlbPpWUD2MPwu9Lr3T3:DOz51FLl7pxdP
Score

9^/10

discovery
- Contacts a large (23031) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Changes its process name
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Impair Defenses

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1