mirai | f7907fd93577b22ba3be2f994e445c5eb196ebc474aa99e61d30a4a4c07dca16 | Triage

Sharing

General

Target

f7907fd93577b22ba3be2f994e445c5eb196ebc474aa99e61d30a4a4c07dca16_JaffaCakes118
Size

152KB
Sample

240418-jmng4sfb89
MD5

baccfac095d7f93d6fb56f00e2542cf0
SHA1

375795450b95232a8fc8d318bac84cda24079624
SHA256

f7907fd93577b22ba3be2f994e445c5eb196ebc474aa99e61d30a4a4c07dca16
SHA512

0baf011f59e34511c36e587888d026d2088a19c432f327b7a2201a9ff5b7342d4e083c42cd17aaccad800c0a15180480cf18fe58be533d57d83499779af2cb5f
SSDEEP

3072:87J9bRaoVf6aWaKzNRDIRQHr7jr/ytxzM/9w44pN:87JzNl6aWaKzNRcRy3/ytZM/9y7

Score

10^/10

mirai mirai discovery

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

C2

cnc.catairlines.net

Targets

- Target
  
  f7907fd93577b22ba3be2f994e445c5eb196ebc474aa99e61d30a4a4c07dca16_JaffaCakes118
- Size
  
  152KB
- MD5
  
  baccfac095d7f93d6fb56f00e2542cf0
- SHA1
  
  375795450b95232a8fc8d318bac84cda24079624
- SHA256
  
  f7907fd93577b22ba3be2f994e445c5eb196ebc474aa99e61d30a4a4c07dca16
- SHA512
  
  0baf011f59e34511c36e587888d026d2088a19c432f327b7a2201a9ff5b7342d4e083c42cd17aaccad800c0a15180480cf18fe58be533d57d83499779af2cb5f
- SSDEEP
  
  3072:87J9bRaoVf6aWaKzNRDIRQHr7jr/ytxzM/9w44pN:87JzNl6aWaKzNRcRy3/ytZM/9y7
Score

9^/10

discovery
- Contacts a large (74720) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1