General

  • Target

    meerkat.mips.elf

  • Size

    91KB

  • Sample

    241208-axxzvsxrfk

  • MD5

    fbe5ac91a018c9223a25bcd6fae27768

  • SHA1

    ac1197283b465b5c30d548e7b94f8bb1c47068f9

  • SHA256

    866fc641153eebb92cc03d926a5b61e14dde88a0d1bd32bb61b1593b4a8ccdd1

  • SHA512

    7f2fca0727a8d0ec8333071cedfcfcd1556430a176824f5547cefdc3fa14484a977f116fc00322d25bb938915d72d7ef3ae6ccd3c073c5627b6e5d3e1b142998

  • SSDEEP

    1536:6Jv3wP53+9DQdtmhwK5jnGgBFpoWA+L1Uxep+FeM:83e3rmhLDBFpoj+L1UdFb

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      meerkat.mips.elf

    • Size

      91KB

    • MD5

      fbe5ac91a018c9223a25bcd6fae27768

    • SHA1

      ac1197283b465b5c30d548e7b94f8bb1c47068f9

    • SHA256

      866fc641153eebb92cc03d926a5b61e14dde88a0d1bd32bb61b1593b4a8ccdd1

    • SHA512

      7f2fca0727a8d0ec8333071cedfcfcd1556430a176824f5547cefdc3fa14484a977f116fc00322d25bb938915d72d7ef3ae6ccd3c073c5627b6e5d3e1b142998

    • SSDEEP

      1536:6Jv3wP53+9DQdtmhwK5jnGgBFpoWA+L1Uxep+FeM:83e3rmhLDBFpoj+L1UdFb

    • Contacts a large (22874) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

MITRE ATT&CK Enterprise v15

Tasks