General

  • Target

    ssh.sh

  • Size

    639B

  • Sample

    241123-vwlknavmbq

  • MD5

    61f6f361a8641428ec15e652569064b8

  • SHA1

    f3c5b2338ce425c32eec3abd2310ba992bd3ab94

  • SHA256

    ce3ca0522b38c3931522cac2f1218dbc231624674dcc80ce76b4a26ecffdd8f1

  • SHA512

    0402ef7c2bd4100f3c40ec5d2a60fe1060cd5a42f4762dd398e685db82abd221df7f260be27a3c95394ba7b0665556b2e22f860f23bf6fceda6651e1048471fe

Malware Config

Extracted

Family

mirai

C2

gay.nguyenletriloc.pro

Targets

    • Target

      ssh.sh

    • Size

      639B

    • MD5

      61f6f361a8641428ec15e652569064b8

    • SHA1

      f3c5b2338ce425c32eec3abd2310ba992bd3ab94

    • SHA256

      ce3ca0522b38c3931522cac2f1218dbc231624674dcc80ce76b4a26ecffdd8f1

    • SHA512

      0402ef7c2bd4100f3c40ec5d2a60fe1060cd5a42f4762dd398e685db82abd221df7f260be27a3c95394ba7b0665556b2e22f860f23bf6fceda6651e1048471fe

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Mirai family

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

    • Deletes itself

    • Executes dropped EXE

    • Traces itself

      Traces itself to prevent debugging attempts

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

MITRE ATT&CK Enterprise v15

Tasks