Overview

overview

10

Static

static

7

r.arm7.elf

debian-9-armhf

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    r.arm7.elf

  • Size

    57KB

  • Sample

    240102-233wvaeda4

  • MD5

    08f4c5922075254540922f40706e8502

  • SHA1

    79b9c5a9e378cdfaa579767e9f1915fefd02bae6

  • SHA256

    f76f3d2a4869993480d8d78173440b74d79206085f27d43c2531faffe99121e6

  • SHA512

    d3242be69e39a47bc97097316310df0aec1ed6d5d3c4141ce0523176326782a026b8f88b9bb436de1acd7809d84f15a06dbe6a83a7e0a3a15a3d60095e7b79aa

  • SSDEEP

    1536:jtFA7HNhtkIua2eJuZIMRdgCmKiDyhLtK53DBK7YQ:jEtsPKsRdgNKKyhLCsX

Score
10/10
miraibotnetupx

Malware Config

Targets

    • Target

      r.arm7.elf

    • Size

      57KB

    • MD5

      08f4c5922075254540922f40706e8502

    • SHA1

      79b9c5a9e378cdfaa579767e9f1915fefd02bae6

    • SHA256

      f76f3d2a4869993480d8d78173440b74d79206085f27d43c2531faffe99121e6

    • SHA512

      d3242be69e39a47bc97097316310df0aec1ed6d5d3c4141ce0523176326782a026b8f88b9bb436de1acd7809d84f15a06dbe6a83a7e0a3a15a3d60095e7b79aa

    • SSDEEP

      1536:jtFA7HNhtkIua2eJuZIMRdgCmKiDyhLtK53DBK7YQ:jEtsPKsRdgNKKyhLCsX

    Score
    10/10
    miraibotnet

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Changes its process name

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks