Overview

overview

10

Static

static

10

700-1-0x00...ry.dmp

debian-9-mipsel

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    700-1-0x00400000-0x00456a28-memory.dmp

  • Size

    89KB

  • Sample

    240324-jvdb4sdg2x

  • MD5

    347a181c427be6e37cbc716a060749a1

  • SHA1

    b96fe24084fcaab0ac3c6e429baec91d7097b095

  • SHA256

    66caa6c44a68d79842bdadaccfa66066f07dc56f405aa5b0a8880cf720be6006

  • SHA512

    be110572c96cbd91ddead73b552de74533413c88dc825f1ee4dd0d0d69d862ad47dae6649af3794cbe2c4cc212ec1238cbea66bb8b1422e4d1f8ebe17c0d15a0

  • SSDEEP

    1536:E+/IwNuowUj02Gc2fsw0fNQQPO2u32llQ167morkZRH:R/lNujzfHuw6+jH

Score
10/10
mirailzrddiscovery

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      700-1-0x00400000-0x00456a28-memory.dmp

    • Size

      89KB

    • MD5

      347a181c427be6e37cbc716a060749a1

    • SHA1

      b96fe24084fcaab0ac3c6e429baec91d7097b095

    • SHA256

      66caa6c44a68d79842bdadaccfa66066f07dc56f405aa5b0a8880cf720be6006

    • SHA512

      be110572c96cbd91ddead73b552de74533413c88dc825f1ee4dd0d0d69d862ad47dae6649af3794cbe2c4cc212ec1238cbea66bb8b1422e4d1f8ebe17c0d15a0

    • SSDEEP

      1536:E+/IwNuowUj02Gc2fsw0fNQQPO2u32llQ167morkZRH:R/lNujzfHuw6+jH

    Score
    9/10
    discovery

    • Contacts a large (20734) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Network Service Discovery

2
T1046

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks