General

  • Target

    nshkarm.elf

  • Size

    73KB

  • Sample

    241220-te5frszlfk

  • MD5

    ca724231e8f15b40416ed5fb823d1db1

  • SHA1

    5799cc8103e03f0d96818d7149ebe959fbd56922

  • SHA256

    82382f6c525bb2d1fa1a22f59fc6c3454e3e2078d987c755e029bd92b4463c84

  • SHA512

    758133083cda70bb91b12dea77a4171fe90c6e6169ddce0f67594fd67f1bec1b319d46fec56bd6b6799e863b5a7ae189a5ccc9a358543983404a867f3294040c

  • SSDEEP

    1536:JlvJbQfW4mskR+k9dh/5X/itga5nS5M/+mR0earvjzk:JltQf0skRfV/5viGa5nSYrWjzk

Score
10/10

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

Targets

    • Target

      nshkarm.elf

    • Size

      73KB

    • MD5

      ca724231e8f15b40416ed5fb823d1db1

    • SHA1

      5799cc8103e03f0d96818d7149ebe959fbd56922

    • SHA256

      82382f6c525bb2d1fa1a22f59fc6c3454e3e2078d987c755e029bd92b4463c84

    • SHA512

      758133083cda70bb91b12dea77a4171fe90c6e6169ddce0f67594fd67f1bec1b319d46fec56bd6b6799e863b5a7ae189a5ccc9a358543983404a867f3294040c

    • SSDEEP

      1536:JlvJbQfW4mskR+k9dh/5X/itga5nS5M/+mR0earvjzk:JltQf0skRfV/5viGa5nSYrWjzk

    Score
    9/10
    • Contacts a large (277869) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

MITRE ATT&CK Enterprise v15

Tasks