General

  • Target

    mips.elf

  • Size

    110KB

  • Sample

    241221-yks25syjfn

  • MD5

    4a16d254a4a373cb01f5a33c05623549

  • SHA1

    a8371b524192de016f5afca6d673969358579097

  • SHA256

    115dde91db57628554eadfb3b552de116b5433cce8b0dd16313cc91fa28f0722

  • SHA512

    9f4d14fc470d5b89ff3b8d6a935235b3eb7b83db14d6f2da15e2ed577dc562ed9f3a3e90c4498cb589ae0316227ab0daa68b8071fed708a62f6f851f32aaa37f

  • SSDEEP

    3072:5znu8TfSyBFataXSdQ0YCtxGCtgWmHdT1PXdT:5zu8TfSyBQ4XSdS2xGEpG5NT

Malware Config

Extracted

Family

mirai

Botnet

OWARI

Targets

    • Target

      mips.elf

    • Size

      110KB

    • MD5

      4a16d254a4a373cb01f5a33c05623549

    • SHA1

      a8371b524192de016f5afca6d673969358579097

    • SHA256

      115dde91db57628554eadfb3b552de116b5433cce8b0dd16313cc91fa28f0722

    • SHA512

      9f4d14fc470d5b89ff3b8d6a935235b3eb7b83db14d6f2da15e2ed577dc562ed9f3a3e90c4498cb589ae0316227ab0daa68b8071fed708a62f6f851f32aaa37f

    • SSDEEP

      3072:5znu8TfSyBFataXSdQ0YCtxGCtgWmHdT1PXdT:5zu8TfSyBQ4XSdS2xGEpG5NT

    • Contacts a large (47777) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks