General

  • Target

    37ad92cca30ef9226eb43c6da6d0658099c3e64373dd11e4e118c69750205880.elf

  • Size

    56KB

  • Sample

    240419-bkvjmscc36

  • MD5

    0e2b118a0ec23dfeca4e088de6959354

  • SHA1

    1ee611d5c9bdfdc0ef03f119193e26d86a1331dc

  • SHA256

    37ad92cca30ef9226eb43c6da6d0658099c3e64373dd11e4e118c69750205880

  • SHA512

    96dbb90aaec2f2a57c2d96cda2df57b5ecea59d199eb3aebef3598a2912367672035d3afdd4ef65acd6986c3da45a6866a7ae4c0381e8d712cebd0bf01593013

  • SSDEEP

    1536:DfVPcxTjoptM6P7eEfgd716NYigL1DDkWmbMfEVxvMQ:DfVECphTjId5kYxDDkWmbj7

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

C2

jswl.bzwl888.sbs

Targets

    • Target

      37ad92cca30ef9226eb43c6da6d0658099c3e64373dd11e4e118c69750205880.elf

    • Size

      56KB

    • MD5

      0e2b118a0ec23dfeca4e088de6959354

    • SHA1

      1ee611d5c9bdfdc0ef03f119193e26d86a1331dc

    • SHA256

      37ad92cca30ef9226eb43c6da6d0658099c3e64373dd11e4e118c69750205880

    • SHA512

      96dbb90aaec2f2a57c2d96cda2df57b5ecea59d199eb3aebef3598a2912367672035d3afdd4ef65acd6986c3da45a6866a7ae4c0381e8d712cebd0bf01593013

    • SSDEEP

      1536:DfVPcxTjoptM6P7eEfgd716NYigL1DDkWmbMfEVxvMQ:DfVECphTjId5kYxDDkWmbj7

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Contacts a large (220937) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Changes its process name

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks