General

  • Target

    arm7.elf

  • Size

    98KB

  • Sample

    241220-rk27gsyjap

  • MD5

    5a4de982460713a6cbb7840a8f641810

  • SHA1

    317678f75bcc2532db211316003a3fd1c0f4a543

  • SHA256

    77713789a43c59b4972ce807f64a3196df5715f640ebd0ec3819ed5109322889

  • SHA512

    a2222860a4d206148e35b82bd348900d246679d595e8430a5ed830d2db9a70fe824ae8fb1d0c0086bcc9b95cc60349d6905e07bec4224a124ce531fb4a2a7091

  • SSDEEP

    3072:PRYl3dN0u0lRp8upaKBbMvOwIVASWcV99OrzheH:PRY/NtepaKBbMvOVV8c79EeH

Score
10/10

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

Targets

    • Target

      arm7.elf

    • Size

      98KB

    • MD5

      5a4de982460713a6cbb7840a8f641810

    • SHA1

      317678f75bcc2532db211316003a3fd1c0f4a543

    • SHA256

      77713789a43c59b4972ce807f64a3196df5715f640ebd0ec3819ed5109322889

    • SHA512

      a2222860a4d206148e35b82bd348900d246679d595e8430a5ed830d2db9a70fe824ae8fb1d0c0086bcc9b95cc60349d6905e07bec4224a124ce531fb4a2a7091

    • SSDEEP

      3072:PRYl3dN0u0lRp8upaKBbMvOwIVASWcV99OrzheH:PRY/NtepaKBbMvOVV8c79EeH

    Score
    9/10
    • Contacts a large (293895) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

MITRE ATT&CK Enterprise v15

Tasks