mirai | 475337617a9efe5318c58168b3ef8cd4efab79b25b50efb9b7717280748f66f5 | Triage

Sharing

General

Target

9b06f804ef7d8c3f702b76dba981f4bc
Size

54KB
Sample

231220-k8t3fshhd8
MD5

9b06f804ef7d8c3f702b76dba981f4bc
SHA1

455220377e656dc00060dbdb0f3a01947f257877
SHA256

475337617a9efe5318c58168b3ef8cd4efab79b25b50efb9b7717280748f66f5
SHA512

8c3632e903bb42c812a6b9b21a96dfe2486b3e504e8a7ab4e44ad5964b914f48c8693fe9929e02ca1250f548cae5ef1b228b2f4ea3a8b39ef9e4c0b9ecea77a0
SSDEEP

1536:7WihQI4yQY3/N5eNIfdcNtQW609AJnS2L4Y4c9lVn:+I4zS/N5eNMdcP+09AA2Lr9

Score

10^/10

mirai bot discovery linux

Malware Config

Extracted

Family

mirai

Botnet

BOT

Targets

- Target
  
  9b06f804ef7d8c3f702b76dba981f4bc
- Size
  
  54KB
- MD5
  
  9b06f804ef7d8c3f702b76dba981f4bc
- SHA1
  
  455220377e656dc00060dbdb0f3a01947f257877
- SHA256
  
  475337617a9efe5318c58168b3ef8cd4efab79b25b50efb9b7717280748f66f5
- SHA512
  
  8c3632e903bb42c812a6b9b21a96dfe2486b3e504e8a7ab4e44ad5964b914f48c8693fe9929e02ca1250f548cae5ef1b228b2f4ea3a8b39ef9e4c0b9ecea77a0
- SSDEEP
  
  1536:7WihQI4yQY3/N5eNIfdcNtQW609AJnS2L4Y4c9lVn:+I4zS/N5eNMdcP+09AA2Lr9
Score

9^/10

discovery
- Contacts a large (254005) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Changes its process name
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Impair Defenses

Hijack Execution Flow

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1