mirai | 2cfe0a164b32f4c3696bff543860f4230b6d8a90607e215d52ebe856818a413c | Triage

Sharing

General

Target

adroidarm7.elf
Size

132KB
Sample

240820-a33gjavdka
MD5

366851c5a73632cf43b87b2812c24c3c
SHA1

483410218bfcd253bbe3f21333623d8697c2c150
SHA256

2cfe0a164b32f4c3696bff543860f4230b6d8a90607e215d52ebe856818a413c
SHA512

91e24454cc56572d8b48e1b92cc4706086f5515391b8a856e7c5a3cc499ca29572a7c55d72e41f67161b64e399c68906c65a8e39890e1afcbf10e9b6667958d3
SSDEEP

3072:5fB//1+yAxK3sjkpmz8s7DffdM/9w/BGWh:5fBHgyAxK3sUmJ7DflM/9w/0S

Score

10^/10

mirai discovery

Malware Config

Targets

- Target
  
  adroidarm7.elf
- Size
  
  132KB
- MD5
  
  366851c5a73632cf43b87b2812c24c3c
- SHA1
  
  483410218bfcd253bbe3f21333623d8697c2c150
- SHA256
  
  2cfe0a164b32f4c3696bff543860f4230b6d8a90607e215d52ebe856818a413c
- SHA512
  
  91e24454cc56572d8b48e1b92cc4706086f5515391b8a856e7c5a3cc499ca29572a7c55d72e41f67161b64e399c68906c65a8e39890e1afcbf10e9b6667958d3
- SSDEEP
  
  3072:5fB//1+yAxK3sjkpmz8s7DffdM/9w/BGWh:5fBHgyAxK3sUmJ7DflM/9w/0S
Score

9^/10

discovery
- Contacts a large (65012) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Deletes itself
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Impair Defenses

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1