Overview

overview

10

Static

static

1

079ac68e03...kes118

debian-9-mips

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    079ac68e03006cd0872918e75d4f8bd9_JaffaCakes118

  • Size

    39KB

  • Sample

    240429-n2nhwaac3z

  • MD5

    079ac68e03006cd0872918e75d4f8bd9

  • SHA1

    f1f1fda7e0fc8a4a45cb244589a84e0f5e3e0d46

  • SHA256

    d6cf9e245910e31d0b7284a4b63e0f65fc8cf77c660129c6bd9577e2ac910b8a

  • SHA512

    023e23e61fbb2250f8680578ecc2ced30a13122749768c08d84932af874d359ecc2750bd472b124c4eb33c8d07431c4717cc1ab07e40ba67ea2d70fb4beaca9d

  • SSDEEP

    768:4nFv6uj8IgwUiNsRgxzMlh2gVnNSY+cfteJgGlzDpxYsjo:mFv6ujwwkgxzys0kY+4KVrYj

Score
10/10
miraikytonbotnetdiscovery

Malware Config

Extracted

Family

mirai

Botnet

KYTON

Targets

    • Target

      079ac68e03006cd0872918e75d4f8bd9_JaffaCakes118

    • Size

      39KB

    • MD5

      079ac68e03006cd0872918e75d4f8bd9

    • SHA1

      f1f1fda7e0fc8a4a45cb244589a84e0f5e3e0d46

    • SHA256

      d6cf9e245910e31d0b7284a4b63e0f65fc8cf77c660129c6bd9577e2ac910b8a

    • SHA512

      023e23e61fbb2250f8680578ecc2ced30a13122749768c08d84932af874d359ecc2750bd472b124c4eb33c8d07431c4717cc1ab07e40ba67ea2d70fb4beaca9d

    • SSDEEP

      768:4nFv6uj8IgwUiNsRgxzMlh2gVnNSY+cfteJgGlzDpxYsjo:mFv6ujwwkgxzys0kY+4KVrYj

    Score
    10/10
    miraikytonbotnetdiscovery

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Contacts a large (112272) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Writes file to system bin folder

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Credential Access

Discovery

Network Service Discovery

2
T1046

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks