Overview

overview

10

Static

static

10

0c1805da32...kes118

ubuntu-20.04-amd64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c1805da32de39d1ce88e7d1f8539453_JaffaCakes118

  • Size

    125KB

  • Sample

    240501-savkbsbf22

  • MD5

    0c1805da32de39d1ce88e7d1f8539453

  • SHA1

    552b633cf47ed08ddf7851ed41e95f06f341f085

  • SHA256

    4d1db7b1fa56fd7020fee11a981ab2ddc681cba8bf82ee28301ffb9059e371d9

  • SHA512

    994c707cf60fec60493f75105715bbcd3d4776092228ce775d2aaf6d2b35c1edad4bdbbe0d18167430158f2eb150b3ea5b943bd9261c06af73294ac0c53e7620

  • SSDEEP

    3072:VCHM3D0VpjMGukk+jxKbDu+zJSlUUjkoMHdyDH:8s3D0VpjMGuNW0OWdQH

Score
10/10
miraimiraidiscoverylinux

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Targets

    • Target

      0c1805da32de39d1ce88e7d1f8539453_JaffaCakes118

    • Size

      125KB

    • MD5

      0c1805da32de39d1ce88e7d1f8539453

    • SHA1

      552b633cf47ed08ddf7851ed41e95f06f341f085

    • SHA256

      4d1db7b1fa56fd7020fee11a981ab2ddc681cba8bf82ee28301ffb9059e371d9

    • SHA512

      994c707cf60fec60493f75105715bbcd3d4776092228ce775d2aaf6d2b35c1edad4bdbbe0d18167430158f2eb150b3ea5b943bd9261c06af73294ac0c53e7620

    • SSDEEP

      3072:VCHM3D0VpjMGukk+jxKbDu+zJSlUUjkoMHdyDH:8s3D0VpjMGuNW0OWdQH

    Score
    9/10
    discovery

    • Contacts a large (602449) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Network Service Discovery

2
T1046

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks