General

  • Target

    3e03e6c5c24e3d7af651744dc5b6b88a.bin

  • Size

    88KB

  • Sample

    241205-blc1zswpdj

  • MD5

    34222a52fbae5b84b82777fe5d02e80a

  • SHA1

    21cb94a2d87fdf3036163f88fa4c176f3edc933f

  • SHA256

    3ab1ac93e22090c519f7b7f2ba3e8cb073834243d1f0d3cfefd8fb84c6f05d06

  • SHA512

    356be5331edae26f0342608d20ad980f862eeac18b2309576239f938c5b642360769c01cad27da3eb8d8945ec255a616c09312e94fdd5cf25774efb8e2cfb663

  • SSDEEP

    1536:SOwGPdQV2Jkf0DrRCe4UwXfEPg3DwUQZqn98l1BHrhDKJBP:v51e2JM0nM1UcEPNG+XHrIJ1

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

Targets

    • Target

      4552c115a47e1882ec87f4a4d0319763201cce7876b916d55332928b552bc1ad.elf

    • Size

      199KB

    • MD5

      3e03e6c5c24e3d7af651744dc5b6b88a

    • SHA1

      3b72156fb6f8245af090c089be01fcb6c42fc110

    • SHA256

      4552c115a47e1882ec87f4a4d0319763201cce7876b916d55332928b552bc1ad

    • SHA512

      5887f5f5f394b7ee8a03cee473e2e660c25fabf901deba34d62441fed228e06f70f998ddb24ebd4133795ab542c4c6a3a67063a68f96d016655c836bd17b7a16

    • SSDEEP

      6144:Q43n3ziAve1ABavXksxMbcVYY/KxtM/R+77oJxA:Q433zw1ABavXksxMFNxW/fJG

    • Contacts a large (71661) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks