General

  • Target

    arm.elf

  • Size

    65KB

  • Sample

    241216-lc36xsvqbk

  • MD5

    00379715ee052ead8d691231a33b2dab

  • SHA1

    1060f71db35d6fa514e778db987a96e0f3a6fb3d

  • SHA256

    e85edd53f53dede79af2c62b8b8f4e817118106abbb314415eae6d678b1cd133

  • SHA512

    99a326a8b7acedf6bf56af08e800d76ed45822426b00c657fcc59e396538b465007ecd16fd2cff1f3ce9f35173d78032b3101b428c771bfb9f2aa7f8baac2e07

  • SSDEEP

    1536:rNHlxvmiiBmLv/RN/596y04BxF+2YWfwz2vvW+:rNprxIn4BxF+5sbv7

Malware Config

Extracted

Family

mirai

C2

230.btc-f2pool.top

Targets

    • Target

      arm.elf

    • Size

      65KB

    • MD5

      00379715ee052ead8d691231a33b2dab

    • SHA1

      1060f71db35d6fa514e778db987a96e0f3a6fb3d

    • SHA256

      e85edd53f53dede79af2c62b8b8f4e817118106abbb314415eae6d678b1cd133

    • SHA512

      99a326a8b7acedf6bf56af08e800d76ed45822426b00c657fcc59e396538b465007ecd16fd2cff1f3ce9f35173d78032b3101b428c771bfb9f2aa7f8baac2e07

    • SSDEEP

      1536:rNHlxvmiiBmLv/RN/596y04BxF+2YWfwz2vvW+:rNprxIn4BxF+5sbv7

    • Contacts a large (36851) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

MITRE ATT&CK Enterprise v15

Tasks