Overview

overview

10

Static

static

7

ff5a3c3c0a...kes118

debian-9-mips

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff5a3c3c0ae48940230e9f63cbb8a881_JaffaCakes118

  • Size

    30KB

  • Sample

    240421-qfx7ascb78

  • MD5

    ff5a3c3c0ae48940230e9f63cbb8a881

  • SHA1

    93caee4a6a461482213b283d76f2e4ab5e6765d8

  • SHA256

    d4e4b7ca41b6d0e756e9ea414024e876f4982b9c2d33b50006f1969b53736449

  • SHA512

    e99d74e9708609f121aeba294ff10f9715d97ea4dad858995b2de70d3f4c659a466c701109834c2f42a7789b13df897360c88979be09401a0a24ff156781a426

  • SSDEEP

    768:1/M2ZczvACRtOJFwt5skyZ+gHkm1PyO31+WHJgGlzDpbuR1Jg:10QczYCRtOMWEm1PJrFVJuW

Score
10/10
mirailzrdbotnetdiscoveryupx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      ff5a3c3c0ae48940230e9f63cbb8a881_JaffaCakes118

    • Size

      30KB

    • MD5

      ff5a3c3c0ae48940230e9f63cbb8a881

    • SHA1

      93caee4a6a461482213b283d76f2e4ab5e6765d8

    • SHA256

      d4e4b7ca41b6d0e756e9ea414024e876f4982b9c2d33b50006f1969b53736449

    • SHA512

      e99d74e9708609f121aeba294ff10f9715d97ea4dad858995b2de70d3f4c659a466c701109834c2f42a7789b13df897360c88979be09401a0a24ff156781a426

    • SSDEEP

      768:1/M2ZczvACRtOJFwt5skyZ+gHkm1PyO31+WHJgGlzDpbuR1Jg:10QczYCRtOMWEm1PJrFVJuW

    Score
    10/10
    mirailzrdbotnetdiscovery

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Contacts a large (20722) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks