mirai | 885cad34a13c0ce65c6e632a354dfd7b8520511185caf88556c7f0c79a93b551 | Triage

Sharing

General

Target

f5aff437b04c19339c9be1b96b2982f0
Size

30KB
Sample

231220-vw2lwaeagm
MD5

f5aff437b04c19339c9be1b96b2982f0
SHA1

3265d6ba2b62104cfa6d24b10609857cd50420f1
SHA256

885cad34a13c0ce65c6e632a354dfd7b8520511185caf88556c7f0c79a93b551
SHA512

0ee43492a02fade474f791e7fa7b166a4364fc117ec44e0fc6e8f5009a600ef84aa0ef33802d84db75bb23807f433d24beea67f3f84cde22359824699b583516
SSDEEP

768:5KGMuiPe/7bKFSoDEfUP2VnHJXMDLhK9ga:IGMuiPa7RZVnpXM/hK

Score

10^/10

mirai larry discovery linux

Malware Config

Extracted

Family

mirai

Botnet

LARRY

C2

cnc.junoland.xyz

scan.junoland.xyz

Targets

- Target
  
  f5aff437b04c19339c9be1b96b2982f0
- Size
  
  30KB
- MD5
  
  f5aff437b04c19339c9be1b96b2982f0
- SHA1
  
  3265d6ba2b62104cfa6d24b10609857cd50420f1
- SHA256
  
  885cad34a13c0ce65c6e632a354dfd7b8520511185caf88556c7f0c79a93b551
- SHA512
  
  0ee43492a02fade474f791e7fa7b166a4364fc117ec44e0fc6e8f5009a600ef84aa0ef33802d84db75bb23807f433d24beea67f3f84cde22359824699b583516
- SSDEEP
  
  768:5KGMuiPe/7bKFSoDEfUP2VnHJXMDLhK9ga:IGMuiPa7RZVnpXM/hK
Score

9^/10

discovery
- Contacts a large (53614) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Impair Defenses

Hijack Execution Flow

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1