Overview

overview

10

Static

static

10

e8fe0f983e...kes118

ubuntu-18.04-amd64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e8fe0f983eaf27b565d681b5edd1775eafeb98bb5742d6976aaf176aaa13befb_JaffaCakes118

  • Size

    53KB

  • Sample

    240409-cte1zsbf38

  • MD5

    32bb47bf1ace53b344fd849d61a4820c

  • SHA1

    f3170563647d3b5a9cf8fe114e3992e15e21694e

  • SHA256

    e8fe0f983eaf27b565d681b5edd1775eafeb98bb5742d6976aaf176aaa13befb

  • SHA512

    1dacb533be3c873c66acd33e1cf65a24133527716cdde837a2827b78089ec9454f841832b167212d711c6e341f8cc67d504806cce309772c6ee5cc09fd74e087

  • SSDEEP

    1536:9iabmIQ/ZAsDl9tRJjrTydpZLV82h8Km+rSTWv:9iUzQ/ZAOlJjiTZ582SB+D

Score
10/10
miraimiraidiscoverylinux

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

C2

cnc.catairlines.net

Targets

    • Target

      e8fe0f983eaf27b565d681b5edd1775eafeb98bb5742d6976aaf176aaa13befb_JaffaCakes118

    • Size

      53KB

    • MD5

      32bb47bf1ace53b344fd849d61a4820c

    • SHA1

      f3170563647d3b5a9cf8fe114e3992e15e21694e

    • SHA256

      e8fe0f983eaf27b565d681b5edd1775eafeb98bb5742d6976aaf176aaa13befb

    • SHA512

      1dacb533be3c873c66acd33e1cf65a24133527716cdde837a2827b78089ec9454f841832b167212d711c6e341f8cc67d504806cce309772c6ee5cc09fd74e087

    • SSDEEP

      1536:9iabmIQ/ZAsDl9tRJjrTydpZLV82h8Km+rSTWv:9iUzQ/ZAOlJjiTZ582SB+D

    Score
    9/10
    discovery

    • Contacts a large (72671) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Changes its process name

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks