General

  • Target

    ef8daf11e4d7f6e5ceb5231e5333b9a7.bin

  • Size

    33KB

  • Sample

    241205-cdh3psykaj

  • MD5

    f480666d07b10a232bf90133ab73b034

  • SHA1

    25962e08bcb7789eb5c1feb10c37530ee7086b38

  • SHA256

    5bc8f0a68cc99dc147270c33245599c96c9894d2883f3e88b6bf52978eae7d4f

  • SHA512

    b851d453ecff53112f97ed16fa48223905d42701f783d09573a04e675fa136656d4f6f3aa063b331612b848817b937ff108f293126d37320825c496bcf6562bc

  • SSDEEP

    768:3aHWZvd6nZUn34DzVCzkTTVR5I9Cx10QTxAui0BZif7N:3aSAZUnsygnNT2uzBZifZ

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

Targets

    • Target

      3010da171a6907ee997460ba49c59b50285b1a9e7acca93759d51f81bf6ff01f.elf

    • Size

      87KB

    • MD5

      ef8daf11e4d7f6e5ceb5231e5333b9a7

    • SHA1

      3cb74d506ffaca5a3d2b865a41ba8c4a1943ebda

    • SHA256

      3010da171a6907ee997460ba49c59b50285b1a9e7acca93759d51f81bf6ff01f

    • SHA512

      6091a8a7f6c6f457cf0328e0d3a160eb2f867f6674598bc3afe682928f1e82e81bb307e771331feb808c465bd349690cd013e4ae8a0a8246b81354665c60cf6b

    • SSDEEP

      1536:sC5FAh5hytl3jWNU8mr6RdmZozXKzVuMFhFSwACVElNNEEH4uIj:xrAh2tl3jQU8mrImZozXGdACVElN6EYD

    • Contacts a large (143281) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks