General

  • Target

    hax.mpsl.elf

  • Size

    74KB

  • Sample

    241210-vxj38awnap

  • MD5

    31981bab69c3887f927b8e5356dec337

  • SHA1

    3777816d70794a1263beea355a505e5ed1661f35

  • SHA256

    996bcf37d0bdd96650e224d05ddfaaa10517b8692e7cd2f38def0356d0f148f1

  • SHA512

    a33e8d9f92183ffd0d7b2b008ce5216e3bed6a2c7944ac224482fbf465efe5dab3fe3eec057ff385fbb5e426208c7b0eee413fa4ba33e866316c7f82b4f07f38

  • SSDEEP

    1536:fBZA5LayUi6I/vLDNo7Wgq8AJA2HD4TFZ571wCD:fBZAFaU6I/vLDNyWgrTF

Score
10/10

Malware Config

Extracted

Family

mirai

Botnet

SORA

Targets

    • Target

      hax.mpsl.elf

    • Size

      74KB

    • MD5

      31981bab69c3887f927b8e5356dec337

    • SHA1

      3777816d70794a1263beea355a505e5ed1661f35

    • SHA256

      996bcf37d0bdd96650e224d05ddfaaa10517b8692e7cd2f38def0356d0f148f1

    • SHA512

      a33e8d9f92183ffd0d7b2b008ce5216e3bed6a2c7944ac224482fbf465efe5dab3fe3eec057ff385fbb5e426208c7b0eee413fa4ba33e866316c7f82b4f07f38

    • SSDEEP

      1536:fBZA5LayUi6I/vLDNo7Wgq8AJA2HD4TFZ571wCD:fBZAFaU6I/vLDNyWgrTF

    Score
    9/10
    • Contacts a large (137377) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks