mirai | 33100452278d3d2e6857c61cd3f422547c1bab3395cb14a12eeba5bb1622e5c3 | Triage

Sharing

General

Target

33100452278d3d2e6857c61cd3f422547c1bab3395cb14a12eeba5bb1622e5c3.elf
Size

34KB
Sample

240405-bkzhlagf66
MD5

17a71b71e5c728e4394c067a196a6b7d
SHA1

644f071ab69638ab998403ed07f8131de6e1fdac
SHA256

33100452278d3d2e6857c61cd3f422547c1bab3395cb14a12eeba5bb1622e5c3
SHA512

e8e0912454e331619c6dbd64f470f389e7fc1be2999e66cb32711525a4f6fc1d9bd0c17691582a1738580464bfebf5901f8c45526bd912d22489f0cd58787357
SSDEEP

768:5uK/70MEG8bZTyA5PSfGM5Jzx5dZezxAllR8zqLWs:5VGG8l5PkR5VxotCT

Score

10^/10

mirai botnet upx

Malware Config

Targets

- Target
  
  33100452278d3d2e6857c61cd3f422547c1bab3395cb14a12eeba5bb1622e5c3.elf
- Size
  
  34KB
- MD5
  
  17a71b71e5c728e4394c067a196a6b7d
- SHA1
  
  644f071ab69638ab998403ed07f8131de6e1fdac
- SHA256
  
  33100452278d3d2e6857c61cd3f422547c1bab3395cb14a12eeba5bb1622e5c3
- SHA512
  
  e8e0912454e331619c6dbd64f470f389e7fc1be2999e66cb32711525a4f6fc1d9bd0c17691582a1738580464bfebf5901f8c45526bd912d22489f0cd58787357
- SSDEEP
  
  768:5uK/70MEG8bZTyA5PSfGM5Jzx5dZezxAllR8zqLWs:5VGG8l5PkR5VxotCT
Score

10^/10

mirai botnet
- Mirai
  Mirai is a prevalent Linux malware infecting exposed network devices.
  botnet mirai
- Changes its process name
- Deletes itself
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Traces itself
  Traces itself to prevent debugging attempts
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Impair Defenses

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1