General

  • Target

    firmware.armv7l

  • Size

    133KB

  • Sample

    241123-tq495stnhq

  • MD5

    0870a2df3e83fe76124c4e93c7b2d8e2

  • SHA1

    6cdf840e4849c14774cb60fa4e111ccb15111214

  • SHA256

    ee310a2f85f0381f2afd48584e05763b3bd88e36f1c35468c147e7733617e9d6

  • SHA512

    d88a700356f8f9a75cfd63ad5c660a1aa4ff20d9d6b979d658b805d0153b7180a39f8250fc6b8ec33865653c5bfc0d36df61244ebd3d7702d372dfff1d8216d0

  • SSDEEP

    3072:xWvIGWRyWt1KTcGjFyamva5pOXJBbDDSQNpNVj/sp0a3:xeIGIyWt1KTfQjva5pOXJBbHSQJVrsa4

Malware Config

Extracted

Family

mirai

C2

secure.microsoftconnect.net

binary.microsoftconnect.net

Targets

    • Target

      firmware.armv7l

    • Size

      133KB

    • MD5

      0870a2df3e83fe76124c4e93c7b2d8e2

    • SHA1

      6cdf840e4849c14774cb60fa4e111ccb15111214

    • SHA256

      ee310a2f85f0381f2afd48584e05763b3bd88e36f1c35468c147e7733617e9d6

    • SHA512

      d88a700356f8f9a75cfd63ad5c660a1aa4ff20d9d6b979d658b805d0153b7180a39f8250fc6b8ec33865653c5bfc0d36df61244ebd3d7702d372dfff1d8216d0

    • SSDEEP

      3072:xWvIGWRyWt1KTcGjFyamva5pOXJBbDDSQNpNVj/sp0a3:xeIGIyWt1KTfQjva5pOXJBbHSQJVrsa4

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Mirai family

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks