General

  • Target

    c16a7d61a7d58b1da60b829652e3ede4

  • Size

    31KB

  • Sample

    240311-x8cjmacb9z

  • MD5

    c16a7d61a7d58b1da60b829652e3ede4

  • SHA1

    0eaf84129db36ac99d6ad0d0dcc3f6aeb4c0dfdd

  • SHA256

    be63a1bcbd5207557d3653428dd423ae31613c0e435e39db3ec3fb1db406ea6b

  • SHA512

    1388f32436a061b3dc855d4e3bbc29df6d9366fee779de38c71ce14cecf6f16566867001d1e8e001acf55cc86a04810c17e506ab367357f1477dd9f2e96571c6

  • SSDEEP

    768:nGNYYDM+O2/fN7sUHgV87jA4JgGlzDpxYswj:nGLS2nRsUjXA4VrYXj

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      c16a7d61a7d58b1da60b829652e3ede4

    • Size

      31KB

    • MD5

      c16a7d61a7d58b1da60b829652e3ede4

    • SHA1

      0eaf84129db36ac99d6ad0d0dcc3f6aeb4c0dfdd

    • SHA256

      be63a1bcbd5207557d3653428dd423ae31613c0e435e39db3ec3fb1db406ea6b

    • SHA512

      1388f32436a061b3dc855d4e3bbc29df6d9366fee779de38c71ce14cecf6f16566867001d1e8e001acf55cc86a04810c17e506ab367357f1477dd9f2e96571c6

    • SSDEEP

      768:nGNYYDM+O2/fN7sUHgV87jA4JgGlzDpxYswj:nGLS2nRsUjXA4VrYXj

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Contacts a large (24143) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Impair Defenses

1
T1562

Discovery

Network Service Discovery

2
T1046

Tasks