General

  • Target

    bc6579db06dbba223f77dbe9d6942853.bin

  • Size

    35KB

  • Sample

    241205-b6mqxsxpdp

  • MD5

    c23869c9fe44664a8a14bf33ced0777e

  • SHA1

    ae6773e07b091d5413ce4dc442686be2927fecfa

  • SHA256

    641429071253bd9363fde376cfb2bc019c8573a4d5efd56703780db63a41aa7a

  • SHA512

    f5c7d262bd51f7dced7e71378dc2b38c07942f531104cdb68d07242749e59e5c1f3b727a5e79f9a5efea615c7404d0dc4e30bd426b0ee006f520170a5f13739c

  • SSDEEP

    768:dqcNW8DtuIBzgp7yOvd6Fw3TA+nnTQe2qTAzafSUTzUIKhKrscgTDI4mOkN:oInttBzO7y5FR+nTHB4afpTzVKow/TlG

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

Targets

    • Target

      25ec5bc3a50e86e3b8ad21c36f439087735987097560851fdeafe19b0eeb382f.elf

    • Size

      68KB

    • MD5

      bc6579db06dbba223f77dbe9d6942853

    • SHA1

      b9088dd8560065eefa21c3a4ea64dcfacbadde70

    • SHA256

      25ec5bc3a50e86e3b8ad21c36f439087735987097560851fdeafe19b0eeb382f

    • SHA512

      5e106eaaf15a2a6bde5ae0b90a9bfa37743100a567ad7526db2db94629ae661b900df2efcd5769e50806be2b1afcaf932498c7812445f120603dba0887ae684e

    • SSDEEP

      1536:XeQuwUIu1N6C15xqmX3CFxTykjJ77pyKBeON:XeQuwUF6M3CzWIF7pyKBe

    • Contacts a large (143068) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks