General

  • Target

    skyljne.x86.elf

  • Size

    106KB

  • Sample

    240112-vp9nxacgg4

  • MD5

    59b9f17823753e3c5aa50173162442ef

  • SHA1

    78f93fbe14a16fdb8f514f078805453d93a21ad6

  • SHA256

    db597815bfff48483f47b749fe31ecdb7eeff5ae8876ff96af4157b402edf0a4

  • SHA512

    7b218752bd89576fc8ef6fa7acfc003db4cc4d37fc611847859979ab4dcd9270b567d6eba1bca580e078aa15f7d800eeedb7deb6032f7f3dbfddf1de7a004464

  • SSDEEP

    3072:081GutVwpSvt6r4FHWCFg+HwdFp5xjY+:0Of+p1u3HApXM

Score
10/10

Malware Config

Extracted

Family

mirai

C2

haha.skyljne.click

Targets

    • Target

      skyljne.x86.elf

    • Size

      106KB

    • MD5

      59b9f17823753e3c5aa50173162442ef

    • SHA1

      78f93fbe14a16fdb8f514f078805453d93a21ad6

    • SHA256

      db597815bfff48483f47b749fe31ecdb7eeff5ae8876ff96af4157b402edf0a4

    • SHA512

      7b218752bd89576fc8ef6fa7acfc003db4cc4d37fc611847859979ab4dcd9270b567d6eba1bca580e078aa15f7d800eeedb7deb6032f7f3dbfddf1de7a004464

    • SSDEEP

      3072:081GutVwpSvt6r4FHWCFg+HwdFp5xjY+:0Of+p1u3HApXM

    Score
    9/10
    • Contacts a large (131398) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Changes its process name

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks