mirai | 88272e41dbb45d8da7f039f26932b5c9b50d74a99ec46204be2b8f958609896b

General

Target

4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
Size

28KB
MD5

4c73a5fa3598101708d4bf9c5abd84fb
SHA1

e28ea0fcf2139fbe0b8cdfade3856002ecfd3f95
SHA256

88272e41dbb45d8da7f039f26932b5c9b50d74a99ec46204be2b8f958609896b
SHA512

9fb86c12c2c0ec881fbc262fc2225b3fb107cbec2734b1722a8caf6a6c773eeaef0b08ce763cbadd432a3d5300377254d6767b0e973f3352c5587a3fdf2b1392
SSDEEP

768:+CGP3Jv+tqC3Y+B4Jm3Go1Xehv+xFAtMej9MzGnYvFb:dGRv+tzMJm3Gy4sFzM9MzGYNb

Score

10^/10

mirai mirai botnet discovery

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (20525) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118

description	ioc	process
File opened for modification	/dev/watchdog	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for modification	/dev/misc/watchdog	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118

Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118

description ioc process

File opened for reading /proc/net/tcp 4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
Enumerates running processes
Discovers information about currently running processes on the system
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118

description ioc process

File opened for reading /proc/net/tcp 4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/tcp	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/tcp	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118

description	ioc	process
File opened for reading	/proc/474/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/950/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1060/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1683/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2491/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1480/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/488/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1547/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2437/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2514/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2604/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/959/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1046/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/511/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1170/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1287/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1350/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1949/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/441/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/445/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1930/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/640/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2114/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2170/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2610/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/542/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/638/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1168/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1173/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2495/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1040/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1129/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2173/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1262/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1687/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2462/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/446/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/474/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1716/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2101/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1147/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1486/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2076/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2607/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/569/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1184/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/418/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1943/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2593/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1181/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1485/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/439/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2054/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/470/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1240/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/446/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1605/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1622/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2558/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/712/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1188/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/2442/exe	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1087/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
File opened for reading	/proc/1213/fd	4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118

/tmp/4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
/tmp/4c73a5fa3598101708d4bf9c5abd84fb_JaffaCakes118
1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1479