Overview

overview

10

Static

static

10

aed0bf84c2...66283e

debian-9-armhf

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aed0bf84c27ecc25d01925110c66283e

  • Size

    50KB

  • Sample

    231220-n3jlbaafe6

  • MD5

    aed0bf84c27ecc25d01925110c66283e

  • SHA1

    c4ba75ffef3a09a9fa7d952813a7186650c83725

  • SHA256

    3724d0b6a26f03f37a05545e05df437e34aae7984e439cde0bc70b54b4cb6898

  • SHA512

    4c7035bfb79480c4d136f84d23f57d59a1be6ebcfff36225b4285e431b2a707b2ac5187b9c5c56d6775437c29941f396e80ce584fab79694d7616034a0783088

  • SSDEEP

    768:ZQHXml16Wjl1DC059OOZ6/7wBJ4Yp2BWKk51WdrPBONsjyKo4kNLkGeQTcEKTcMx:bfMBWBWdrBvIeDJTEDGhtrHvux4nA

Score
10/10
miraibotdiscovery

Malware Config

Extracted

Family

mirai

Botnet

BOT

Targets

    • Target

      aed0bf84c27ecc25d01925110c66283e

    • Size

      50KB

    • MD5

      aed0bf84c27ecc25d01925110c66283e

    • SHA1

      c4ba75ffef3a09a9fa7d952813a7186650c83725

    • SHA256

      3724d0b6a26f03f37a05545e05df437e34aae7984e439cde0bc70b54b4cb6898

    • SHA512

      4c7035bfb79480c4d136f84d23f57d59a1be6ebcfff36225b4285e431b2a707b2ac5187b9c5c56d6775437c29941f396e80ce584fab79694d7616034a0783088

    • SSDEEP

      768:ZQHXml16Wjl1DC059OOZ6/7wBJ4Yp2BWKk51WdrPBONsjyKo4kNLkGeQTcEKTcMx:bfMBWBWdrBvIeDJTEDGhtrHvux4nA

    Score
    9/10
    discovery

    • Contacts a large (10077) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Changes its process name

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Credential Access

Discovery

Network Service Discovery

2
T1046

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks