General

  • Target

    rebirth.mips.elf

  • Size

    93KB

  • Sample

    241210-f2j7fsvlhy

  • MD5

    fc2fb5cf20eaaf814bbbbd11f4f7c13a

  • SHA1

    4c592576c269f64d9d12c5e32ee008b8ccea3c1c

  • SHA256

    44647af4a2e634cf0d9b74dde286fe5038902b99bb313e48ccbd0d5d491b2dc8

  • SHA512

    b878d991610d936edca0486000a64e33cf807bf654115a6ad966c8da299b27d68e18ae0353bc8dea8444e230000d517405ff037f9ee9330f066766ad4b8740ae

  • SSDEEP

    1536:MUG0L28+8YYD+mO6LG8QMIFNl6kiTq2VeTkipwbZnDLLq:Mp0L2p8YYD+mO61QMIFNl6kiTq2Bipwk

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Targets

    • Target

      rebirth.mips.elf

    • Size

      93KB

    • MD5

      fc2fb5cf20eaaf814bbbbd11f4f7c13a

    • SHA1

      4c592576c269f64d9d12c5e32ee008b8ccea3c1c

    • SHA256

      44647af4a2e634cf0d9b74dde286fe5038902b99bb313e48ccbd0d5d491b2dc8

    • SHA512

      b878d991610d936edca0486000a64e33cf807bf654115a6ad966c8da299b27d68e18ae0353bc8dea8444e230000d517405ff037f9ee9330f066766ad4b8740ae

    • SSDEEP

      1536:MUG0L28+8YYD+mO6LG8QMIFNl6kiTq2VeTkipwbZnDLLq:Mp0L2p8YYD+mO61QMIFNl6kiTq2Bipwk

    • Contacts a large (23831) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

    • Modifies rc script

      Adding/modifying system rc scripts is a common persistence mechanism.

MITRE ATT&CK Enterprise v15

Tasks