General

  • Target

    8374373a2be97dcc625de716147ff1fe

  • Size

    74KB

  • Sample

    240421-af42vadf89

  • MD5

    8374373a2be97dcc625de716147ff1fe

  • SHA1

    629895abb50371a12550a0720c4c410119dd1d23

  • SHA256

    80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969

  • SHA512

    cb4093b62495432dbd9fec90644556d3dc28dbf455cfc5787dd4d2880cd5221ae7f7a1913642e215fb6be9b4779a262b37f59dac8ba28b05bf9eca0f3e19d9e8

  • SSDEEP

    1536:/AZlz2ROCO6/fvqz/HYmGNZcYKb7k2v2H8pdqE1Cp:/AZIzQAcYKb7k2LpXCp

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Targets

    • Target

      8374373a2be97dcc625de716147ff1fe

    • Size

      74KB

    • MD5

      8374373a2be97dcc625de716147ff1fe

    • SHA1

      629895abb50371a12550a0720c4c410119dd1d23

    • SHA256

      80be879b8377c8c269c366c456d2fcc0336825b0424bee4c20e129e2e1ed8969

    • SHA512

      cb4093b62495432dbd9fec90644556d3dc28dbf455cfc5787dd4d2880cd5221ae7f7a1913642e215fb6be9b4779a262b37f59dac8ba28b05bf9eca0f3e19d9e8

    • SSDEEP

      1536:/AZlz2ROCO6/fvqz/HYmGNZcYKb7k2v2H8pdqE1Cp:/AZIzQAcYKb7k2LpXCp

    Score
    9/10
    • Contacts a large (20451) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Deletes Audit logs

      Deletes logs related to the Linux Audit framework.

    • Deletes itself

    • Deletes system logs

      Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Deletes log files

      Deletes log files on the system.

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Indicator Removal

3
T1070

Impair Defenses

1
T1562

Discovery

Network Service Discovery

2
T1046

Tasks