General

  • Target

    skyljne.arm.elf

  • Size

    149KB

  • Sample

    240111-qdsh2agdhl

  • MD5

    8dc045545b479e66367c7412c4b57bcb

  • SHA1

    eedcd5237356346953d7f2ff1d8df89b08d4fc4b

  • SHA256

    e9dde263d548e82af911eed5cc8331ebad4c66e267815939816cda7b6972c9db

  • SHA512

    325d2693b690391d3322bfb9ac470cf595a189fa48aba14789668b83631eda1b507d6ded1c1ccd9d92bbc2515b67983a43f8d7501b14f29f5a4b4a1754c7cec3

  • SSDEEP

    3072:E02SmV3WCB6FMK64V7mr8cfwjVnMNgIY:E0WWCYiT4Var8csVnMNi

Score
10/10

Malware Config

Extracted

Family

mirai

C2

bngoc.skyljne.click

Targets

    • Target

      skyljne.arm.elf

    • Size

      149KB

    • MD5

      8dc045545b479e66367c7412c4b57bcb

    • SHA1

      eedcd5237356346953d7f2ff1d8df89b08d4fc4b

    • SHA256

      e9dde263d548e82af911eed5cc8331ebad4c66e267815939816cda7b6972c9db

    • SHA512

      325d2693b690391d3322bfb9ac470cf595a189fa48aba14789668b83631eda1b507d6ded1c1ccd9d92bbc2515b67983a43f8d7501b14f29f5a4b4a1754c7cec3

    • SSDEEP

      3072:E02SmV3WCB6FMK64V7mr8cfwjVnMNgIY:E0WWCYiT4Var8csVnMNi

    Score
    9/10
    • Contacts a large (80120) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Changes its process name

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks