General

  • Target

    nshmpsl.elf

  • Size

    95KB

  • Sample

    241220-shbgesxrbv

  • MD5

    39c2ff24a71b04a09452c961e9a132aa

  • SHA1

    925347844780830f97f07ff15a2e80cf0be793d6

  • SHA256

    7c4dda626a053c484794a90ca9093f58a7f563507bb3b4f2b75c6fedb5601bc5

  • SHA512

    34a1a5b5375d15d8f377a1f0ec9ed9e8bf88436174db482c4448976ecb95ff0d44a1667b92a2dfd3392ccf2b11031868374ef4b1538ee966104c76061e3cdff0

  • SSDEEP

    1536:pTwg/ni9+ixt0fiKE3r/7ju/d6qvwnZ78VrFvVv92e8E/4zg:pTwgfsFYDV6qYn2PL/4zg

Score
10/10

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

Targets

    • Target

      nshmpsl.elf

    • Size

      95KB

    • MD5

      39c2ff24a71b04a09452c961e9a132aa

    • SHA1

      925347844780830f97f07ff15a2e80cf0be793d6

    • SHA256

      7c4dda626a053c484794a90ca9093f58a7f563507bb3b4f2b75c6fedb5601bc5

    • SHA512

      34a1a5b5375d15d8f377a1f0ec9ed9e8bf88436174db482c4448976ecb95ff0d44a1667b92a2dfd3392ccf2b11031868374ef4b1538ee966104c76061e3cdff0

    • SSDEEP

      1536:pTwg/ni9+ixt0fiKE3r/7ju/d6qvwnZ78VrFvVv92e8E/4zg:pTwgfsFYDV6qYn2PL/4zg

    Score
    9/10
    • Contacts a large (262942) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

MITRE ATT&CK Enterprise v15

Tasks