General

  • Target

    zmap.arm7.elf

  • Size

    152KB

  • Sample

    241216-sb53fstqbp

  • MD5

    a4def922ea1b16e8304da5d512303dd3

  • SHA1

    54f8320c0ef7f8fe029098cd08eb0236ff8a6e14

  • SHA256

    a7cfe20ac2b16d27cd37982305dffec84730014f4c46dc38bf674bc18f9202d5

  • SHA512

    b56c232d164b12195d9b75673330ee9e94bc18acb99b41ea4f700ffd76da6e8d59d263d40c9f764bf18bcad87c2feff917f34d488cce663c70deddd9e01fb9ed

  • SSDEEP

    3072:gXNsG9xNku0haoanAE+zRzHnbNc57VMzFLSO4PFM/9h7TBA:gXNsiEuNoanL+zRzHbNy+LS7dM/9Zy

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

C2

servers.vlrt-gap.com

Targets

    • Target

      zmap.arm7.elf

    • Size

      152KB

    • MD5

      a4def922ea1b16e8304da5d512303dd3

    • SHA1

      54f8320c0ef7f8fe029098cd08eb0236ff8a6e14

    • SHA256

      a7cfe20ac2b16d27cd37982305dffec84730014f4c46dc38bf674bc18f9202d5

    • SHA512

      b56c232d164b12195d9b75673330ee9e94bc18acb99b41ea4f700ffd76da6e8d59d263d40c9f764bf18bcad87c2feff917f34d488cce663c70deddd9e01fb9ed

    • SSDEEP

      3072:gXNsG9xNku0haoanAE+zRzHnbNc57VMzFLSO4PFM/9h7TBA:gXNsiEuNoanL+zRzHbNy+LS7dM/9Zy

    Score
    7/10
    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks