General

  • Target

    1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118

  • Size

    35KB

  • Sample

    240626-q6gx1axdqc

  • MD5

    1234a7ab6996aea4b3d2e344ea102d81

  • SHA1

    5b6f469940856194a1ed9c933d67e2f91df7ff44

  • SHA256

    62ed5a5e76d64384e85b59acb063773ebcbb542d978b5e3bfc811a7ff5a000e2

  • SHA512

    5ad8afa0b6b13d17a3ae09a6b969712a1a6c61497b8273912fffd1073c7bfb4fba776b190e15b592312643361f0f3720c5ca21b4afcac8c394c4a36988546b75

  • SSDEEP

    768:Gk1Ad+hrTxdXhyT1vSjCXnaOfk2xNS8UFr7YuEtHga7nZA3Us:Gk1AdGrTxdXh4vSjCXaV22vYTAa7nY

Malware Config

Extracted

Family

mirai

Botnet

KYTON

Targets

    • Target

      1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118

    • Size

      35KB

    • MD5

      1234a7ab6996aea4b3d2e344ea102d81

    • SHA1

      5b6f469940856194a1ed9c933d67e2f91df7ff44

    • SHA256

      62ed5a5e76d64384e85b59acb063773ebcbb542d978b5e3bfc811a7ff5a000e2

    • SHA512

      5ad8afa0b6b13d17a3ae09a6b969712a1a6c61497b8273912fffd1073c7bfb4fba776b190e15b592312643361f0f3720c5ca21b4afcac8c394c4a36988546b75

    • SSDEEP

      768:Gk1Ad+hrTxdXhyT1vSjCXnaOfk2xNS8UFr7YuEtHga7nZA3Us:Gk1AdGrTxdXh4vSjCXaV22vYTAa7nY

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Contacts a large (112291) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks