mirai | b33dc6aeb20c36bac04e5abcba4bbbc8de00814393c9a78bd799a56908ccfadb | Triage

Sharing

General

Target

b6473b46b7ddcde6646f1d7874f33d6c
Size

42KB
Sample

231220-qcgedagee3
MD5

b6473b46b7ddcde6646f1d7874f33d6c
SHA1

f719425530fad5af1290a4fe0936c3526c6afb5d
SHA256

b33dc6aeb20c36bac04e5abcba4bbbc8de00814393c9a78bd799a56908ccfadb
SHA512

da32ff3d02f584a8ad46f8afa7824e55a965ba58958ae5502d0345e3f5900573a8a422fb208ebf3f74a72dc8150ace863ec4d7e0536dbdb3bd21340afedd16ba
SSDEEP

768:fz1bX7aCb4MvLR+EoW+W6Uj9Ujtq3nlg8T5cp1:b1rbb4BS9cqXe8T5a1

Score

10^/10

mirai orphic discovery linux

Malware Config

Extracted

Family

mirai

Botnet

ORPHIC

C2

cnc.isisnet.xyz

scan.isisnet.xyz

Targets

- Target
  
  b6473b46b7ddcde6646f1d7874f33d6c
- Size
  
  42KB
- MD5
  
  b6473b46b7ddcde6646f1d7874f33d6c
- SHA1
  
  f719425530fad5af1290a4fe0936c3526c6afb5d
- SHA256
  
  b33dc6aeb20c36bac04e5abcba4bbbc8de00814393c9a78bd799a56908ccfadb
- SHA512
  
  da32ff3d02f584a8ad46f8afa7824e55a965ba58958ae5502d0345e3f5900573a8a422fb208ebf3f74a72dc8150ace863ec4d7e0536dbdb3bd21340afedd16ba
- SSDEEP
  
  768:fz1bX7aCb4MvLR+EoW+W6Uj9Ujtq3nlg8T5cp1:b1rbb4BS9cqXe8T5a1
Score

9^/10

discovery
- Contacts a large (57580) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Changes its process name
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Impair Defenses

Hijack Execution Flow

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1