General

  • Target

    31dd438c323b07e86776ba7c69fb8444.elf

  • Size

    37KB

  • Sample

    240315-qsynlabf67

  • MD5

    31dd438c323b07e86776ba7c69fb8444

  • SHA1

    94bc81ca8b54fe8c26fcf5de553eac160352e3c8

  • SHA256

    0e9029207f1f762275fa9d5bf88a547004ebbe8b430bc0fda325f8f7a88920c7

  • SHA512

    e15d5697358691471213b83b976c2bd919a05060cfcabfe3f29a21b0df02eccbf941c149fb33ae9d3c70c733acec1d0a2210033cbdf7a205d22e753840be0cd2

  • SSDEEP

    768:6ryDw+2jd+xIPTWri8wklJugN7V3NwXVAaceiV5og:7w+2j02PirrigN7jwXVxceivog

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

C2

zyzy.duckdns.org

Targets

    • Target

      31dd438c323b07e86776ba7c69fb8444.elf

    • Size

      37KB

    • MD5

      31dd438c323b07e86776ba7c69fb8444

    • SHA1

      94bc81ca8b54fe8c26fcf5de553eac160352e3c8

    • SHA256

      0e9029207f1f762275fa9d5bf88a547004ebbe8b430bc0fda325f8f7a88920c7

    • SHA512

      e15d5697358691471213b83b976c2bd919a05060cfcabfe3f29a21b0df02eccbf941c149fb33ae9d3c70c733acec1d0a2210033cbdf7a205d22e753840be0cd2

    • SSDEEP

      768:6ryDw+2jd+xIPTWri8wklJugN7V3NwXVAaceiV5og:7w+2j02PirrigN7jwXVxceivog

    Score
    9/10
    • Contacts a large (76260) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Changes its process name

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks