General

  • Target

    648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf

  • Size

    74KB

  • Sample

    240416-bktmcafd21

  • MD5

    20d263bd6e0552cad17ec45eeff1844b

  • SHA1

    67a23901d5f3276ba4e8c95c21aeb79ca584a36a

  • SHA256

    648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b

  • SHA512

    f721ddcbcb19d22057d8a4b7402fa8d852872b3df3de18a13b8c983407fb29cd06ef7b9c35c4c50a179ac98fd2e70296806487fc59d4a9e291fa248662ac5eef

  • SSDEEP

    1536:EUPldq0TJFnqXKvdo7DYZXjs56tbWuhyN/XemIdRI1R+5vY1SLq7wTVVi:9NdDznqoK7D4s5UWxem0I1R+JeSOcTf

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Targets

    • Target

      648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf

    • Size

      74KB

    • MD5

      20d263bd6e0552cad17ec45eeff1844b

    • SHA1

      67a23901d5f3276ba4e8c95c21aeb79ca584a36a

    • SHA256

      648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b

    • SHA512

      f721ddcbcb19d22057d8a4b7402fa8d852872b3df3de18a13b8c983407fb29cd06ef7b9c35c4c50a179ac98fd2e70296806487fc59d4a9e291fa248662ac5eef

    • SSDEEP

      1536:EUPldq0TJFnqXKvdo7DYZXjs56tbWuhyN/XemIdRI1R+5vY1SLq7wTVVi:9NdDznqoK7D4s5UWxem0I1R+JeSOcTf

    Score
    7/10
    • Changes its process name

    • Deletes Audit logs

      Deletes logs related to the Linux Audit framework.

    • Deletes itself

    • Deletes journal logs

      Deletes systemd journal logs. Likely to evade detection.

    • Deletes system logs

      Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Indicator Removal

3
T1070

Impair Defenses

1
T1562

Discovery

System Information Discovery

1
T1082

Tasks