General
-
Target
SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf
-
Size
30KB
-
Sample
240802-nxvfmawerk
-
MD5
2a53030bb17ff781f18e413ff5d0b67f
-
SHA1
a511d1efd9acac2e01baa8b1aeb4d85c25e31c7d
-
SHA256
19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33
-
SHA512
b1c724e23656974178df590acde4eb1941e36c907f5ef48c8a5bbe8c5b18502b96d81a89b7eaef3ec0ee5156093bf5b2f1badfd6d1e997337467d31afd02a7a2
-
SSDEEP
768:GHiX0hIAjIBfYwftE+k4TG4u6idlBiBjFEqftvJgGlzDpbuR1Je:GWEIBwwftlPCezttVJuw
Malware Config
Extracted
mirai
MIRAI
Targets
-
-
Target
SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf
-
Size
30KB
-
MD5
2a53030bb17ff781f18e413ff5d0b67f
-
SHA1
a511d1efd9acac2e01baa8b1aeb4d85c25e31c7d
-
SHA256
19e560c38521164cb9f28a26cde7a4579754e6471ebd86ea7e7c3d77c0496a33
-
SHA512
b1c724e23656974178df590acde4eb1941e36c907f5ef48c8a5bbe8c5b18502b96d81a89b7eaef3ec0ee5156093bf5b2f1badfd6d1e997337467d31afd02a7a2
-
SSDEEP
768:GHiX0hIAjIBfYwftE+k4TG4u6idlBiBjFEqftvJgGlzDpbuR1Je:GWEIBwwftlPCezttVJuw
-
Contacts a large (20541) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-