General

  • Target

    x86_64

  • Size

    74KB

  • Sample

    240425-ymnv7sea73

  • MD5

    296cfde231042f4a645a26c25bf13a09

  • SHA1

    a56da7a9c0511c08ab22bdf7d9f1ec0e1f6f7709

  • SHA256

    b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11

  • SHA512

    cc8996561ae9691bcb6ed2b57cd9926276d3d131794bcefffbb047b4956650111c853a3f8845c0dd9d2cfbda6de2d681f1fb5bcdfb1d23169482623e94015ab0

  • SSDEEP

    1536:JEfduRD5QPhnK/toxtIpunxn6ksx2mPx7yGMRmINK1Ga8hWaLYXw5VR:UdkOPhoaxtzxn6GmJyRmT1GtWacA57

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Targets

    • Target

      x86_64

    • Size

      74KB

    • MD5

      296cfde231042f4a645a26c25bf13a09

    • SHA1

      a56da7a9c0511c08ab22bdf7d9f1ec0e1f6f7709

    • SHA256

      b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11

    • SHA512

      cc8996561ae9691bcb6ed2b57cd9926276d3d131794bcefffbb047b4956650111c853a3f8845c0dd9d2cfbda6de2d681f1fb5bcdfb1d23169482623e94015ab0

    • SSDEEP

      1536:JEfduRD5QPhnK/toxtIpunxn6ksx2mPx7yGMRmINK1Ga8hWaLYXw5VR:UdkOPhoaxtzxn6GmJyRmT1GtWacA57

    Score
    7/10
    • Deletes Audit logs

      Deletes logs related to the Linux Audit framework.

    • Deletes itself

    • Deletes journal logs

      Deletes systemd journal logs. Likely to evade detection.

    • Deletes system logs

      Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Deletes log files

      Deletes log files on the system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Indicator Removal

4
T1070

Impair Defenses

1
T1562

Discovery

System Information Discovery

1
T1082

Tasks