General
-
Target
a5da1900a3eae7081b8d3597b7dc6d76
-
Size
31KB
-
Sample
240226-j1snzsgg65
-
MD5
a5da1900a3eae7081b8d3597b7dc6d76
-
SHA1
9ead127cf2c89c36fca872bd25e8882f8bbf3c05
-
SHA256
e2a6d5e68983635d01a85dd8e5539dc9bab7c0cc2fe47dbffd647b1ed2f72675
-
SHA512
beb8b8c976e2076080127125f435fadd15142313ace1c58841bb84c69a87bf08e9a10ea9f2be488d88aa23c0790c4a23dca967688a5fa86ba7590dfed7b243ca
-
SSDEEP
768:hha+tXWMLELCROUQ3uZC5wwS7n3J/XZHA8DWW2:K+tXTLEeRi+AlonVXHC
Malware Config
Extracted
mirai
LZRD
Targets
-
-
Target
a5da1900a3eae7081b8d3597b7dc6d76
-
Size
31KB
-
MD5
a5da1900a3eae7081b8d3597b7dc6d76
-
SHA1
9ead127cf2c89c36fca872bd25e8882f8bbf3c05
-
SHA256
e2a6d5e68983635d01a85dd8e5539dc9bab7c0cc2fe47dbffd647b1ed2f72675
-
SHA512
beb8b8c976e2076080127125f435fadd15142313ace1c58841bb84c69a87bf08e9a10ea9f2be488d88aa23c0790c4a23dca967688a5fa86ba7590dfed7b243ca
-
SSDEEP
768:hha+tXWMLELCROUQ3uZC5wwS7n3J/XZHA8DWW2:K+tXTLEeRi+AlonVXHC
-
Contacts a large (20384) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-