mirai | 81668fc09cbfd26747009ae2df8de413c13cab94bd42ca4b168c1717e66aef65 | Triage

Sharing

General

Target

612c87fd35c8ef7af4947100de47c83b.bin
Size

32KB
Sample

240325-cjy14sdb79
MD5

0f7d9367a732c4de4778dd6224132eb7
SHA1

412ff04371cc0fe318a020a35dc84f403196339d
SHA256

81668fc09cbfd26747009ae2df8de413c13cab94bd42ca4b168c1717e66aef65
SHA512

e9ea0645902e72475686eb98e4d7817ae817158b0edcab32ac12079c7d939d33aaded779ffe4d7062bbcb3273118e80743ff0a09623390f486281024fdfad0ad
SSDEEP

768:hhxdhcCh3lB7BtZDSaOj0JIe3ky1anq/B:hhWCpL7BCaOYCe3xanqJ

Score

10^/10

mirai antivm linux

Malware Config

Extracted

Family

mirai

C2

185.196.8.213

Targets

- Target
  
  10b7a0dcffc39b8f72848715c1515f4b5e2ab229ca52d3099c726f9c738e1cd4.elf
- Size
  
  57KB
- MD5
  
  612c87fd35c8ef7af4947100de47c83b
- SHA1
  
  8899c509ed9715f61eb1f9791c6637389e84412a
- SHA256
  
  10b7a0dcffc39b8f72848715c1515f4b5e2ab229ca52d3099c726f9c738e1cd4
- SHA512
  
  ea52dbc5b124a2756cc2c8505b487acdf6556b714f986e1aa409f2508f077a8517f008cf41fb2a751d1500951c9259d4e7f21f7662570ccb698f86dfc5fcef40
- SSDEEP
  
  1536:v0f5JN+LtFC7GXkEL7sz+XZE/cy4jr2+/ST:v0BJN+LtA+kEXsqJWclqb
Score

7^/10

antivm
- Changes its process name
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Checks CPU configuration
  Checks CPU information which indicate if the system is a virtual machine.
  antivm
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Impair Defenses

Virtualization/Sandbox Evasion

Hijack Execution Flow

Credential Access

Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1