General

  • Target

    3b862ea93c64e99f59dfb50f8c2a69e8_JaffaCakes118

  • Size

    31KB

  • Sample

    241012-xcxvpazcmn

  • MD5

    3b862ea93c64e99f59dfb50f8c2a69e8

  • SHA1

    6cfbdcbc17d23ecf19248acef8a6aafd3c7c7b47

  • SHA256

    328f81c0becfa068ba9107948898ae7f1a38cd394079cb2987cc8bdae559f0b3

  • SHA512

    1f63a529b6f66ac06105fae8842e7c218db840c8c477dd458ec08dd4482713d3b8012ce3775be4271242c8ade8a1177fbd90bfdbd3987bd07ca34235fc7fc5cc

  • SSDEEP

    384:hYpLGER/WQ2t4kleTDy8FJnLv0yf+foF6frES/DBeXZU0rdxcnPad3vUdjRWGVCA:JEFg4kyDTLxMzwS/9Qa05ynyhstWc

Malware Config

Extracted

Family

mirai

Botnet

UNST

Targets

    • Target

      3b862ea93c64e99f59dfb50f8c2a69e8_JaffaCakes118

    • Size

      31KB

    • MD5

      3b862ea93c64e99f59dfb50f8c2a69e8

    • SHA1

      6cfbdcbc17d23ecf19248acef8a6aafd3c7c7b47

    • SHA256

      328f81c0becfa068ba9107948898ae7f1a38cd394079cb2987cc8bdae559f0b3

    • SHA512

      1f63a529b6f66ac06105fae8842e7c218db840c8c477dd458ec08dd4482713d3b8012ce3775be4271242c8ade8a1177fbd90bfdbd3987bd07ca34235fc7fc5cc

    • SSDEEP

      384:hYpLGER/WQ2t4kleTDy8FJnLv0yf+foF6frES/DBeXZU0rdxcnPad3vUdjRWGVCA:JEFg4kyDTLxMzwS/9Qa05ynyhstWc

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Contacts a large (20487) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks