General

  • Target

    arm5.elf

  • Size

    71KB

  • Sample

    241220-rrt5fsykal

  • MD5

    ff002090b86651736f989b2261665414

  • SHA1

    5b033860197e2a362be08b3a6c4c7b08b573ecc8

  • SHA256

    aa396f49fc2df74ddfeb4bb7bab084078deea4d908444305b73ab292730251df

  • SHA512

    7f3144b2350ab16e2ed57f52f21a13c13d4a7650a8dcdf73143bf428c7a6b02fbdd89dcc0cd1162faa0bb9d0f40d166f06584a7cb70d3dbdd913e23db2f980fa

  • SSDEEP

    1536:jcwwVlCxvfkU5Npk9dRa5i9tPoy/2IqJSrkmqjJ1zk:IwwnwkiOda5i9Foy/2IruDzk

Score
10/10

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

Targets

    • Target

      arm5.elf

    • Size

      71KB

    • MD5

      ff002090b86651736f989b2261665414

    • SHA1

      5b033860197e2a362be08b3a6c4c7b08b573ecc8

    • SHA256

      aa396f49fc2df74ddfeb4bb7bab084078deea4d908444305b73ab292730251df

    • SHA512

      7f3144b2350ab16e2ed57f52f21a13c13d4a7650a8dcdf73143bf428c7a6b02fbdd89dcc0cd1162faa0bb9d0f40d166f06584a7cb70d3dbdd913e23db2f980fa

    • SSDEEP

      1536:jcwwVlCxvfkU5Npk9dRa5i9tPoy/2IqJSrkmqjJ1zk:IwwnwkiOda5i9Foy/2IruDzk

    Score
    9/10
    • Contacts a large (287707) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks