mirai | 92e42f10b866c7518523cdbea1160b773d52c0594b82057d20b8d9e8e1a784bd | Triage

Sharing

General

Target

eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
Size

24KB
Sample

240919-ha2zasvfkg
MD5

eac4091aa1562432e55b2b64f8cd8bed
SHA1

ee84178a44dd54da0d1ef49d83faf2b9cc865a35
SHA256

92e42f10b866c7518523cdbea1160b773d52c0594b82057d20b8d9e8e1a784bd
SHA512

f5baa1dad8159b25d2cbe9fa7dcc9f7de38a4ecf0e8416cff8accbf905d84cf94e520619551408e74e4710f6a4d716394cb68648d4b0659c87c5f6b6e0ec41ac
SSDEEP

384:j4ZFcgAasNX4oLGx9kz+KgnlU8QAtwGFv/Y+z238xdticulcibfq3xh1l9v2ox2h:jTg/KWlfrth/HtdRulcibibvEPp

Score

10^/10

mirai botnet credential_access defense_evasion discovery upx

Malware Config

Targets

- Target
  
  eac4091aa1562432e55b2b64f8cd8bed_JaffaCakes118
- Size
  
  24KB
- MD5
  
  eac4091aa1562432e55b2b64f8cd8bed
- SHA1
  
  ee84178a44dd54da0d1ef49d83faf2b9cc865a35
- SHA256
  
  92e42f10b866c7518523cdbea1160b773d52c0594b82057d20b8d9e8e1a784bd
- SHA512
  
  f5baa1dad8159b25d2cbe9fa7dcc9f7de38a4ecf0e8416cff8accbf905d84cf94e520619551408e74e4710f6a4d716394cb68648d4b0659c87c5f6b6e0ec41ac
- SSDEEP
  
  384:j4ZFcgAasNX4oLGx9kz+KgnlU8QAtwGFv/Y+z238xdticulcibfq3xh1l9v2ox2h:jTg/KWlfrth/HtdRulcibibvEPp
Score

10^/10

mirai botnet credential_access defense_evasion discovery
- Mirai
  Mirai is a prevalent Linux malware infecting exposed network devices.
  botnet mirai
- Contacts a large (145964) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Reads process memory
  Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
  credential_access
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Credential Access

OS Credential Dumping

Proc Filesystem

Discovery

Network Service Discovery

System Network Configuration Discovery

Internet Connection Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

miraibotnetcredential_accessdefense_evasiondiscovery