General

  • Target

    4552c115a47e1882ec87f4a4d0319763201cce7876b916d55332928b552bc1ad.elf

  • Size

    199KB

  • Sample

    241204-cxy82asmgk

  • MD5

    3e03e6c5c24e3d7af651744dc5b6b88a

  • SHA1

    3b72156fb6f8245af090c089be01fcb6c42fc110

  • SHA256

    4552c115a47e1882ec87f4a4d0319763201cce7876b916d55332928b552bc1ad

  • SHA512

    5887f5f5f394b7ee8a03cee473e2e660c25fabf901deba34d62441fed228e06f70f998ddb24ebd4133795ab542c4c6a3a67063a68f96d016655c836bd17b7a16

  • SSDEEP

    6144:Q43n3ziAve1ABavXksxMbcVYY/KxtM/R+77oJxA:Q433zw1ABavXksxMFNxW/fJG

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

Targets

    • Target

      4552c115a47e1882ec87f4a4d0319763201cce7876b916d55332928b552bc1ad.elf

    • Size

      199KB

    • MD5

      3e03e6c5c24e3d7af651744dc5b6b88a

    • SHA1

      3b72156fb6f8245af090c089be01fcb6c42fc110

    • SHA256

      4552c115a47e1882ec87f4a4d0319763201cce7876b916d55332928b552bc1ad

    • SHA512

      5887f5f5f394b7ee8a03cee473e2e660c25fabf901deba34d62441fed228e06f70f998ddb24ebd4133795ab542c4c6a3a67063a68f96d016655c836bd17b7a16

    • SSDEEP

      6144:Q43n3ziAve1ABavXksxMbcVYY/KxtM/R+77oJxA:Q433zw1ABavXksxMFNxW/fJG

    • Contacts a large (72662) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks