General

  • Target

    0x86d.mips.elf

  • Size

    94KB

  • Sample

    241213-lczthawkdn

  • MD5

    8313ef1ec385a18d98c685a881f71369

  • SHA1

    bacd04b740cf3746c6f27ba541c9fa92993d086a

  • SHA256

    5e7556d72f0cf4702c1e92658173c54df2c8375fce57cbb27ee4d3f8958fbffb

  • SHA512

    6fd356cad5964aae692f042db02da531dc725caa2fbd75ebc78d557966e843e64520a55743e1b0344552523b538a5e9894c02ba1bdfa18747392c2cf86790652

  • SSDEEP

    1536:mF4tsbv54o+3bPhXhWvJ55zO6n2fy+cZeo6XCLKD:mF4tsr54o+rPhkL5zO6n2fy+cYXCLI

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

C2

jinhj.stressamp.com

rgvsf.stressamp.com

Targets

    • Target

      0x86d.mips.elf

    • Size

      94KB

    • MD5

      8313ef1ec385a18d98c685a881f71369

    • SHA1

      bacd04b740cf3746c6f27ba541c9fa92993d086a

    • SHA256

      5e7556d72f0cf4702c1e92658173c54df2c8375fce57cbb27ee4d3f8958fbffb

    • SHA512

      6fd356cad5964aae692f042db02da531dc725caa2fbd75ebc78d557966e843e64520a55743e1b0344552523b538a5e9894c02ba1bdfa18747392c2cf86790652

    • SSDEEP

      1536:mF4tsbv54o+3bPhXhWvJ55zO6n2fy+cZeo6XCLKD:mF4tsr54o+rPhkL5zO6n2fy+cYXCLI

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks