General

  • Target

    58795d4c9d5f620b48ccf3a5a15d1901.bin

  • Size

    35KB

  • Sample

    241205-bp25aa1kdy

  • MD5

    d6b8f42b9241bed01ea07d70ec9ed193

  • SHA1

    a2149349bc69988a4656facc21a4dfafab26df92

  • SHA256

    9d52daba895032dda34f46a71c6fd77af6d06fde436b54f129deae6ac09d3cea

  • SHA512

    3b43d6df7efd807da5b9e5ef586db81810aa03189659587deaae91b7ac2b1b2984b2b9eab2c3d415485271c975d540ec81feef664651d7f6d0526e39135f044a

  • SSDEEP

    768:rWTV15vp6F0PqWliEa0A73aXvtumz6gjJ903NwGlGSPQs53T3TaU:rWVvpMq2C9z6gjywGlGsQs53TDaU

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

Targets

    • Target

      e6e192914b00a8295a96acf98020aab0c3db88329b0d0b209e99682e6c6492e1.elf

    • Size

      90KB

    • MD5

      58795d4c9d5f620b48ccf3a5a15d1901

    • SHA1

      4163f71b6cfbdd2a860654b2c02c821af400ab5c

    • SHA256

      e6e192914b00a8295a96acf98020aab0c3db88329b0d0b209e99682e6c6492e1

    • SHA512

      05df4d4f672f8d0d82a529db2d8877098ccbb40480a7282d6059737af87ae67928b8cbe75c59d709580e77dde0b28f96a5badbc060be5bcea59f4331bfe34104

    • SSDEEP

      1536:VE8u+s5gBkvOWgsBZ936oqGxSmZ9lPOPPu:G8q5gGOHsDSm

    • Contacts a large (115984) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks