General

  • Target

    jew.mips.elf

  • Size

    78KB

  • Sample

    241217-1dletszlcm

  • MD5

    65b03bf6b160459c8b54f501b1c41bc2

  • SHA1

    666eb4d1911bb9c64317ef0c9011da3ca38eba80

  • SHA256

    7679a531460d697fa7bfaa52fd266843a7281e0691df91135c48b7886cbe42db

  • SHA512

    de9a315c1d4fbf96430402a66dcd686ca92a38d473e77741f5ba544a42311574db5690f25f854ebf8aac43129f1d36b3b7440a73d910c4b91f48cf57e16d9ea1

  • SSDEEP

    1536:lo89L2T27mQaXcn6EyvXqaQSiIHW5VU+6Y3jfhdR2QEc8LMk3d42+T7w:lo+2TIaXIE6aZiIH0VU+6KfhdR2Hc8LL

Malware Config

Extracted

Family

mirai

Botnet

KURC

Targets

    • Target

      jew.mips.elf

    • Size

      78KB

    • MD5

      65b03bf6b160459c8b54f501b1c41bc2

    • SHA1

      666eb4d1911bb9c64317ef0c9011da3ca38eba80

    • SHA256

      7679a531460d697fa7bfaa52fd266843a7281e0691df91135c48b7886cbe42db

    • SHA512

      de9a315c1d4fbf96430402a66dcd686ca92a38d473e77741f5ba544a42311574db5690f25f854ebf8aac43129f1d36b3b7440a73d910c4b91f48cf57e16d9ea1

    • SSDEEP

      1536:lo89L2T27mQaXcn6EyvXqaQSiIHW5VU+6Y3jfhdR2QEc8LMk3d42+T7w:lo+2TIaXIE6aZiIH0VU+6KfhdR2Hc8LL

    • Contacts a large (115768) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks