General

  • Target

    ff42180e5eca780ab282744d3832bb84c16ed606e340bd2c57a399a7bc5ee770.elf

  • Size

    24KB

  • Sample

    240411-ccd3cshc93

  • MD5

    e3e44596bde9334e415f91cb5fc796dc

  • SHA1

    4d29e555b63847f93b4b92adf3b7284e805d7512

  • SHA256

    ff42180e5eca780ab282744d3832bb84c16ed606e340bd2c57a399a7bc5ee770

  • SHA512

    6e3db4ba81a93ec1a00bdf174d29d236a537f1ba16ab368921dfe073c9de7578eb9ae2f5e76fba9da8c724494a6c1b78fc460f7b04cd93a8aee55a8c87e60072

  • SSDEEP

    768:XaXNE15Lv4R+DeIc7ormIedTHJhs3Uoze:XaXi15g+DeIpa7TpMze

Score
10/10

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Targets

    • Target

      ff42180e5eca780ab282744d3832bb84c16ed606e340bd2c57a399a7bc5ee770.elf

    • Size

      24KB

    • MD5

      e3e44596bde9334e415f91cb5fc796dc

    • SHA1

      4d29e555b63847f93b4b92adf3b7284e805d7512

    • SHA256

      ff42180e5eca780ab282744d3832bb84c16ed606e340bd2c57a399a7bc5ee770

    • SHA512

      6e3db4ba81a93ec1a00bdf174d29d236a537f1ba16ab368921dfe073c9de7578eb9ae2f5e76fba9da8c724494a6c1b78fc460f7b04cd93a8aee55a8c87e60072

    • SSDEEP

      768:XaXNE15Lv4R+DeIc7ormIedTHJhs3Uoze:XaXi15g+DeIpa7TpMze

    Score
    10/10
    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Impair Defenses

1
T1562

Discovery

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Tasks