General

  • Target

    mips.elf

  • Size

    34KB

  • Sample

    241211-1qgmeazket

  • MD5

    6088a204e0792a10d3724e836fe699b7

  • SHA1

    fc1cf1010c99f155c46f94ec0529c8cea32c6055

  • SHA256

    345984c9618d8bbf1c6e4a70ea62edd4666132f3787dbf07ad118d620cab8a2e

  • SHA512

    bdf6dd68777d986f952a9d3aa5e505aaf360cda74d336c81f5ae1abebdebbdeb595f7bcdb26187f3c59fafbf545265b126435e3ead4346898f328e408bf8e48e

  • SSDEEP

    768:z052m3xoQhvf7nndwx3KcOJNV42KHNJgGlzDpbuR1JW:O201hvzda6cgNV42mVJug

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

Targets

    • Target

      mips.elf

    • Size

      34KB

    • MD5

      6088a204e0792a10d3724e836fe699b7

    • SHA1

      fc1cf1010c99f155c46f94ec0529c8cea32c6055

    • SHA256

      345984c9618d8bbf1c6e4a70ea62edd4666132f3787dbf07ad118d620cab8a2e

    • SHA512

      bdf6dd68777d986f952a9d3aa5e505aaf360cda74d336c81f5ae1abebdebbdeb595f7bcdb26187f3c59fafbf545265b126435e3ead4346898f328e408bf8e48e

    • SSDEEP

      768:z052m3xoQhvf7nndwx3KcOJNV42KHNJgGlzDpbuR1JW:O201hvzda6cgNV42mVJug

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Mirai family

    • Contacts a large (113356) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

MITRE ATT&CK Enterprise v15

Tasks