General
-
Target
a1290d640aa665ae83ccef931a655008
-
Size
81KB
-
Sample
231220-mb3dnscgc9
-
MD5
a1290d640aa665ae83ccef931a655008
-
SHA1
d57e3d69465c3ae0d79a9fa52919f28dd635cc8d
-
SHA256
6e01662285eb3847b7dc263bbc2d77b6f5ee40c1cbb6671543c079265b259922
-
SHA512
bfd305cb7092b38040f463803df42bdea05114c0394e270c44aeb32aeed4eb2d96c6bd2254613ec62c727ea910248a0ae0e7272e035017186c56502b88928e67
-
SSDEEP
1536:KTzVZoobfdRwVoOU31MXU1TqSReShcn0yqK+o/EcKnFqqvw2wCxRnF:KTEoblm21MBweSC0yqK+oab9
Behavioral task
behavioral1
Sample
a1290d640aa665ae83ccef931a655008
Resource
debian9-armhf-20231215-en
Malware Config
Extracted
mirai
BOT
Targets
-
-
Target
a1290d640aa665ae83ccef931a655008
-
Size
81KB
-
MD5
a1290d640aa665ae83ccef931a655008
-
SHA1
d57e3d69465c3ae0d79a9fa52919f28dd635cc8d
-
SHA256
6e01662285eb3847b7dc263bbc2d77b6f5ee40c1cbb6671543c079265b259922
-
SHA512
bfd305cb7092b38040f463803df42bdea05114c0394e270c44aeb32aeed4eb2d96c6bd2254613ec62c727ea910248a0ae0e7272e035017186c56502b88928e67
-
SSDEEP
1536:KTzVZoobfdRwVoOU31MXU1TqSReShcn0yqK+o/EcKnFqqvw2wCxRnF:KTEoblm21MBweSC0yqK+oab9
Score9/10-
Contacts a large (291994) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Changes its process name
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Writes file to system bin folder
-