General

  • Target

    loligang.mpsl.elf

  • Size

    103KB

  • Sample

    241218-vc1v8swpdl

  • MD5

    1633776dee8ef5eb8c80e95364ee26e3

  • SHA1

    f205e6078e98a9233f90bb8a0bd2b4c79a23a413

  • SHA256

    33dc056b0f01ec8c878617d649800c32d387ef0e73ace537894a86c42cb7ee6d

  • SHA512

    35e944be00e6980c215b682aa2b1a9f670d3cacbc5b7ff8e952213c24ad45fa562f8b94723272bb615140d2de53a65346cd4486d04e17a92fcc7d510ce94ff12

  • SSDEEP

    1536:d7fjpr4NEQu3p0ZwIGH5PbpTBRRtBeiZebzELYtiYp:d7fjpr53pndeis9Q2

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      loligang.mpsl.elf

    • Size

      103KB

    • MD5

      1633776dee8ef5eb8c80e95364ee26e3

    • SHA1

      f205e6078e98a9233f90bb8a0bd2b4c79a23a413

    • SHA256

      33dc056b0f01ec8c878617d649800c32d387ef0e73ace537894a86c42cb7ee6d

    • SHA512

      35e944be00e6980c215b682aa2b1a9f670d3cacbc5b7ff8e952213c24ad45fa562f8b94723272bb615140d2de53a65346cd4486d04e17a92fcc7d510ce94ff12

    • SSDEEP

      1536:d7fjpr4NEQu3p0ZwIGH5PbpTBRRtBeiZebzELYtiYp:d7fjpr53pndeis9Q2

    • Contacts a large (16606) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.