General

  • Target

    3834a88651cf8d5302f28d30ca8adefa3c4a181edc08e0716d13d4ebb25f17f0.elf

  • Size

    29KB

  • Sample

    240221-dqqtraad3z

  • MD5

    3b1a84de07c889721cc7578b4af128c8

  • SHA1

    1671885698b090bcec516516c179d1f90905d53f

  • SHA256

    3834a88651cf8d5302f28d30ca8adefa3c4a181edc08e0716d13d4ebb25f17f0

  • SHA512

    27397619a8ef2d8395d86e19ede6bc7f87ebab6bedacce0713792358743140ba3b2db0ade4a656b709002f3ee28e0f540487d6e51611a663508aaeddadf78430

  • SSDEEP

    768:I3wbd+LfaL4xHsSU6SZivnChiNRaoA46PTYn3llbzZa:Ig+s6SZ0Raoey39a

Malware Config

Targets

    • Target

      3834a88651cf8d5302f28d30ca8adefa3c4a181edc08e0716d13d4ebb25f17f0.elf

    • Size

      29KB

    • MD5

      3b1a84de07c889721cc7578b4af128c8

    • SHA1

      1671885698b090bcec516516c179d1f90905d53f

    • SHA256

      3834a88651cf8d5302f28d30ca8adefa3c4a181edc08e0716d13d4ebb25f17f0

    • SHA512

      27397619a8ef2d8395d86e19ede6bc7f87ebab6bedacce0713792358743140ba3b2db0ade4a656b709002f3ee28e0f540487d6e51611a663508aaeddadf78430

    • SSDEEP

      768:I3wbd+LfaL4xHsSU6SZivnChiNRaoA46PTYn3llbzZa:Ig+s6SZ0Raoey39a

    Score
    10/10
    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Changes its process name

    • Deletes Audit logs

      Deletes logs related to the Linux Audit framework.

    • Deletes itself

    • Deletes journal logs

      Deletes systemd journal logs. Likely to evade detection.

    • Deletes system logs

      Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

MITRE ATT&CK Enterprise v15

Tasks