General

  • Target

    nshmpsl.elf

  • Size

    95KB

  • Sample

    241221-rxa9ja1pbj

  • MD5

    7d96f7c335b32996baad95989032ddce

  • SHA1

    39a824a1d279466142b6fa40b41d424ff4b40e4c

  • SHA256

    5b4ed7327c412f656765f26ac2876d8d3fe63f596c246fcf00c548aad19170e0

  • SHA512

    cbff4a75fda1960e01a2d8ee2eee5034a4ce9e2b93a834dd8e692005a4829e356cf2b27c6c766880aedf58586e5bde8f78954653c285994516fc65b86ec43ec0

  • SSDEEP

    1536:xoovHIiF3uyRx0He3WrvLzOPqxK/Q3Z7IBzTNvtvN2u3b/Nzg:xoovoI3tskixKI3CnX/Nzg

Score
10/10

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

Targets

    • Target

      nshmpsl.elf

    • Size

      95KB

    • MD5

      7d96f7c335b32996baad95989032ddce

    • SHA1

      39a824a1d279466142b6fa40b41d424ff4b40e4c

    • SHA256

      5b4ed7327c412f656765f26ac2876d8d3fe63f596c246fcf00c548aad19170e0

    • SHA512

      cbff4a75fda1960e01a2d8ee2eee5034a4ce9e2b93a834dd8e692005a4829e356cf2b27c6c766880aedf58586e5bde8f78954653c285994516fc65b86ec43ec0

    • SSDEEP

      1536:xoovHIiF3uyRx0He3WrvLzOPqxK/Q3Z7IBzTNvtvN2u3b/Nzg:xoovoI3tskixKI3CnX/Nzg

    Score
    9/10
    • Contacts a large (274938) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

MITRE ATT&CK Enterprise v15

Tasks