General

  • Target

    meerkat.arm

  • Size

    85KB

  • Sample

    241112-x1h2fazalr

  • MD5

    6692e37013bfe2b7ef6264cb7f4cdc2c

  • SHA1

    bd0c76d971d900dec846904a75a254bd2a651abd

  • SHA256

    d3c2fb9ba2b21aeb8605d6997e8a0520723294e49df3718e3affa10b744879bb

  • SHA512

    7793f1768ce3fc26597a74281f0655bd9f5dbf0a4ff3312e747759fb8eab8e9525b97398bc7201ff6090643d68592023792b0c21c26bcd1d3a1b70786083a053

  • SSDEEP

    1536:x1O0ykyDy+AHLrP+zjdbYnLsQT7Lp2V259ATz4WbLuOWXcqU1lLH8hP6juJ5QB2G:xI0zyDy+A18WX74FchCjuiIuH

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      meerkat.arm

    • Size

      85KB

    • MD5

      6692e37013bfe2b7ef6264cb7f4cdc2c

    • SHA1

      bd0c76d971d900dec846904a75a254bd2a651abd

    • SHA256

      d3c2fb9ba2b21aeb8605d6997e8a0520723294e49df3718e3affa10b744879bb

    • SHA512

      7793f1768ce3fc26597a74281f0655bd9f5dbf0a4ff3312e747759fb8eab8e9525b97398bc7201ff6090643d68592023792b0c21c26bcd1d3a1b70786083a053

    • SSDEEP

      1536:x1O0ykyDy+AHLrP+zjdbYnLsQT7Lp2V259ATz4WbLuOWXcqU1lLH8hP6juJ5QB2G:xI0zyDy+A18WX74FchCjuiIuH

    • Contacts a large (23672) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

MITRE ATT&CK Enterprise v15

Tasks