General

  • Target
    71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh
  • Size 1KB
  • Sample241106-df6gfstcnf
  • SHA256 71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • mirai

Botnet
  • MIRAI

C2
  • net.igxhost.ru

Extracted

Family
  • mirai

Botnet
  • MIRAI

C2
  • net.igxhost.ru

Extracted

Family
  • mirai

Botnet
  • MIRAI

C2
  • net.igxhost.ru

Extracted

Family
  • mirai

Botnet
  • MIRAI

Targets

    • Target
      71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh
    • Size 1KB
    • SHA256 71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5
    • MD5 SHA1 SHA512
    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Mirai family

    • Contacts a large (23674) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks