General

  • Target

    zmap.arm.elf

  • Size

    74KB

  • Sample

    241029-sagcpsvnes

  • MD5

    823958d1dbb59368ec9cb465345ede82

  • SHA1

    4246851d3b9f1b59c45e2069fc1e204fa2937fc6

  • SHA256

    ce3fcb923990e59f2bcee0f811a868fa7a0abf2a461b54974977d1db6e940aee

  • SHA512

    2598ed24790e8e29fe7e54c8b06c65bc58a55348a0eb20359d6b25eeee0d5565b5746915c6f07f6149f8c0fa8ffac3a060bb7b794d36dbfeaeb40f8aebe4803d

  • SSDEEP

    1536:+jdTb69MAWg92P72qa9H4S5wPX6WZeqLeBZebFvTsA:+jd14H4QWZetb0Ts

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

Targets

    • Target

      zmap.arm.elf

    • Size

      74KB

    • MD5

      823958d1dbb59368ec9cb465345ede82

    • SHA1

      4246851d3b9f1b59c45e2069fc1e204fa2937fc6

    • SHA256

      ce3fcb923990e59f2bcee0f811a868fa7a0abf2a461b54974977d1db6e940aee

    • SHA512

      2598ed24790e8e29fe7e54c8b06c65bc58a55348a0eb20359d6b25eeee0d5565b5746915c6f07f6149f8c0fa8ffac3a060bb7b794d36dbfeaeb40f8aebe4803d

    • SSDEEP

      1536:+jdTb69MAWg92P72qa9H4S5wPX6WZeqLeBZebFvTsA:+jd14H4QWZetb0Ts

    Score
    7/10
    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks