mirai | 8bc2c42c5f38ecdcc9c3c1b630638d6cdae9c3a06ce4602b74d3e8ebff9a7f74 | Triage

Sharing

General

Target

jew.mpsl.elf
Size

86KB
Sample

240701-z3wrestfnj
MD5

ea1a69894f740cee70dabfe41b43230b
SHA1

2d3ac620a4904c1f33bf4848e493090c5fc8263a
SHA256

8bc2c42c5f38ecdcc9c3c1b630638d6cdae9c3a06ce4602b74d3e8ebff9a7f74
SHA512

dd7b19bb8efcfddff6ef70a724eb06326a9318474719390a542a8fb7a4fd540e1866486b40784214af78edacb0dfed6fda4d6fe6c1bc19557a08d908ec5aa2a6
SSDEEP

1536:Jy7hMnfFfacHNfwoix3sJBsipZiZfJYd42+:JehMnflxBwlipP

Score

10^/10

mirai kurc discovery

Malware Config

Extracted

Family

mirai

Botnet

KURC

Targets

- Target
  
  jew.mpsl.elf
- Size
  
  86KB
- MD5
  
  ea1a69894f740cee70dabfe41b43230b
- SHA1
  
  2d3ac620a4904c1f33bf4848e493090c5fc8263a
- SHA256
  
  8bc2c42c5f38ecdcc9c3c1b630638d6cdae9c3a06ce4602b74d3e8ebff9a7f74
- SHA512
  
  dd7b19bb8efcfddff6ef70a724eb06326a9318474719390a542a8fb7a4fd540e1866486b40784214af78edacb0dfed6fda4d6fe6c1bc19557a08d908ec5aa2a6
- SSDEEP
  
  1536:Jy7hMnfFfacHNfwoix3sJBsipZiZfJYd42+:JehMnflxBwlipP
Score

9^/10

discovery
- Contacts a large (117974) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Impair Defenses

Hijack Execution Flow

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1