mirai | 0bd05d1e8e311cd4e49f81c1836cbbeb22d4b191dcdbb39387f859b3e225a65b | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DiscordBotClient-win-x64.exe
Size 80.6MB
Sample241223-3q37hsvrer
SHA256 0bd05d1e8e311cd4e49f81c1836cbbeb22d4b191dcdbb39387f859b3e225a65b
MD5 335c34643ac39ab75c885b0ed3a05af4
SHA1 3e9159a25a8f4f6fbd8c3a8dcd8cf820e37ef838
SHA512 c8baf5b0ead89c66ab4408b6e897cbaf9a30c61cadf56e0197c1df24e424bb302b3d6b411e26c1c3f4d73806bda5e3e7785174b443f49bd8c99883301e02e118
SSDEEP 1572864:RMVwbM7w/U1vK7z/36KdHl/dp4jh41hPlJNrz/6fjIehib5e4r8r87rJ:Rcw4w/LztdF/2qzPlJkjI8+5xr8g7V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mirai discovery execution ransomware

Malware Config

Targets

- Target
  DiscordBotClient-win-x64.exe
- Size 80.6MB
- SHA256 0bd05d1e8e311cd4e49f81c1836cbbeb22d4b191dcdbb39387f859b3e225a65b
- MD5 335c34643ac39ab75c885b0ed3a05af4
- SHA1 3e9159a25a8f4f6fbd8c3a8dcd8cf820e37ef838
- SHA512 c8baf5b0ead89c66ab4408b6e897cbaf9a30c61cadf56e0197c1df24e424bb302b3d6b411e26c1c3f4d73806bda5e3e7785174b443f49bd8c99883301e02e118
- SSDEEP 1572864:RMVwbM7w/U1vK7z/36KdHl/dp4jh41hPlJNrz/6fjIehib5e4r8r87rJ:Rcw4w/LztdF/2qzPlJkjI8+5xr8g7V
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

discovery ransomware
- Renames multiple (253) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  resources/app/node_modules/call-bind/callBound.js
- Size 413B
- SHA256 2b2fce7622fdd680256d28bcd59c30913546a825bf69d754d21a1d21ccc2928c
- MD5 fda064fefaeb89252271922954d69a4f
- SHA1 7bac1561b456a282abe97cb9bc4e5e0d8a10e769
- SHA512 b0746c9dc90bb513e7d6190470ce0acbb0c2059b97184b9391f581e9a490729669c8479ba8eaafc1980f4e058a396bad11031d048387b5223a7b4b9e6a4b1dae
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral3 behavioral4
- Target
  resources/app/node_modules/call-bind/index.js
- Size 1KB
- SHA256 6b4ea26f8ca351cee55da416500ffca72fdb14eb5909f1512ce8ca68e47d7621
- MD5 40109fa1aade9c89c9587e77011f7301
- SHA1 91f8eaf2fba5ee5c36e33207feeceee846c3e04a
- SHA512 d308a91b496c9fbd2db7d8b907d660142172342e990755093d892cf2b8382504119593bb83882f37db71e925803c37b9b098edc748f09eb6dc3f84b8dcc28f9b
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral5 behavioral6
- Target
  resources/app/node_modules/caseless/index.js
- Size 1KB
- SHA256 f2412aa16e0e9b9005db15ed93b9be3ba3bd3d3963b9483c6469f78f789b9fe9
- MD5 8158f3b3e5d07a788ab91bc5e0e6dade
- SHA1 49a6a654b1bdc4e119895edc96a1ee4bb519a38c
- SHA512 73f4f35d3b9e4e80461bd400b98571dd72da9dbdef7bbd4b64abba3c13cfab46024186dd9b4f5f7a7d11f16f5e5e76ff97126b414010b651ad168248a5c8dd31
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral7 behavioral8
- Target
  resources/app/node_modules/caseless/test.js
- Size 1KB
- SHA256 389f6cdc706479afead74984d181967a1152e649e3b466c0c2f08846b9c209c2
- MD5 38863a49f32b4ba2e82be47d89f99528
- SHA1 9cbbc1b43bd3b86518885b2c82f0d8c302e68ed9
- SHA512 ce3b6fc3457daa162b3eb50e707e4e06463dd5cb93bea62db0e7bf9715c5c932dee8c839bdc776b974018bc8556706ff2239ec08bc13ab5c92173c06270ca762
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral10 behavioral9
- Target
  resources/app/node_modules/chalk/source/index.js
- Size 5KB
- SHA256 a7eda1e88414e0e3f050a09621a35e8d656550077da044606c16b053148f6459
- MD5 588c36823b6c659ef060ce6141852923
- SHA1 8c580aa7500d9969056a236df949fefc3db41905
- SHA512 6e6f6bd9fc4f1b9be9c1df2a866dbec68cdc04169a42c7da4667fe4cd69b68647bd27572d5dd8fbc139ec9a4606ebdaffd9b23ac439b6c0e9f36d0d021a58cf3
- SSDEEP 96:a+fArgAqpmB1i5n5UXDJojKfa4y5R8tf//Wkyz8UYyYnuAIAMpAeDJWf8gGEGHNs:a3pCGMPUTJM89//WkUAOJWfzLY0HtXY+
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral11 behavioral12
- Target
  resources/app/node_modules/chalk/source/templates.js
- Size 3KB
- SHA256 546f8511507d2e842cac590f99dc550dfe2b21f7fdcd12ab071ff5aaa3e770d5
- MD5 7f7e2a37129bc942c81337a3c5650762
- SHA1 78be8c6e3e4f697b25364689e10b61fff1a99405
- SHA512 d9b1f8849e09ebe0ccce0995993ccf7f83ee38f9414cefbf0ef34dcae21d42f315ccad4032a40eebdd7751765e338423fe7fb4e5b85b71d5debbe3bba894d9f8
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/app/node_modules/chalk/source/util.js
- Size 1KB
- SHA256 9d5cbee8050b580d28fc1de92987ee0237cf609415da8dc781920074f278c016
- MD5 188694918d042aa89a37678275adc01e
- SHA1 4cb1e8afae9bc10f49a678034e835399ab9c0bcd
- SHA512 9e2449cf9cd108e7d15bc68c57b45ab4ecbb84b8ec7d6c2e7a367a47aa4ede65c7c4aa570b39940be77214c666730c1fa5250ac76740345b6e0eef852ccf8a52
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app/node_modules/cli-truncate/index.js
- Size 2KB
- SHA256 4331f894ede3aeefc6cc4b830e0ad957ad3462cb37fc1c0d95cb1945ce6b1f14
- MD5 d638556942b03eb423d92aabc6ca729b
- SHA1 9d1e837873478c57d656b90b323a3e784dcaeb47
- SHA512 8f92df69bf105a88b223e85437593b02a1eefb2b461988ef9aeb1fe59c4954bce11c734abecf3e5addb7b9d06bc3ee1de021ee7032b8976d904beef7adf2ab54
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app/node_modules/color-convert/conversions.js
- Size 16KB
- SHA256 7225058075157fc78115b8be998a2effdfc1e5b3316b004a130ee5f19303574b
- MD5 321a8a9efc224622cca13fae1b954a1d
- SHA1 a05aaba7fa837594b8d939b6c47b5cef148a1773
- SHA512 d1dbaab34145159f6b9cdf552f24a4e817e98369d330b7cad8d28d9a71dde33601d57f36e0e6cbadafee8a3df4dac525f7a47d164f262fe8afdf0dd1f0847abc
- SSDEEP 384:q9Q/Q1OEwZ/jMAXAUq1gmPF6kReiwY+BRqJDqXB4WF76uoNUjW6:bjd7OmDRqJ2XB4WFu2
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app/node_modules/color-convert/index.js
- Size 1KB
- SHA256 adb610f9a2fbba92548161871075262496b563dcd0e5e8f5c20f562160a74b34
- MD5 6174d1641fae837a527f69c1a16d0f1c
- SHA1 0660bad6704f1ec15ece242a7a15a7721ef727be
- SHA512 fb2bd0916b04c64593856912b1a45034d575a7619df1e2f495712b11dfdd9a78f7d8a290dfc8785ddc1978c623057687836c6e460dbe62ab8c2a9874452ada59
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app/node_modules/color-convert/route.js
- Size 2KB
- SHA256 5f1420af4a106eaa68ed7b4bb5e46f47e0f251169e38841ec8262447e4691b5d
- MD5 ff30f2b9f4a3761be9d12787f059f625
- SHA1 01005d1f2b540c4df7e02fb7ac06c60ba3bae371
- SHA512 141f74f51ee662fc5a263e0cb193c47c8eb66201a27dd1a146d253efb413684c7107e3910a02167de8c649693929fe1781f79a6783d6115e2ca17b7adef9c594
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app/node_modules/color-name/index.js
- Size 4KB
- SHA256 97dabd7ebb70c33c19ccfa6956377fc722d9769924903f42a3bede30d83a8592
- MD5 405840ec3052209f357288fe4c0f4414
- SHA1 db20105dc898fa8aa6706492502431c680c0dc94
- SHA512 9de93ee7b458a9d6b97664022909ad25a7cb89c2cfdd8ee19aa2e126566b7a7a930b24143a2a76f83dbff19f1a67b0a71de93e8ab248720c2ee243396e869451
- SSDEEP 48:2UjYDSI/sGH0LU2pkptyuoD+5Q1gEeHScW1wsb8RkMq+txMtuWJaf+DUC5xVO:Z8DSdGepkpguogQKmqstuWJafYU
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app/node_modules/combined-stream/lib/combined_stream.js
- Size 4KB
- SHA256 f3ef1f988ac4292df828cead080b96a2a97bdce1ab8f44f76345820c58ce7b59
- MD5 3c61efa65d157bdd549e80b01996bf98
- SHA1 952620a43b9cbcb4134a3b8282dfdee87bdc5812
- SHA512 34b2491b80fddb57e830c0ad52a9b6da9efc75655490b117a1fd8bb464959d54ac2585ddd6726975fb60a4017d33af50f844c4311f1570c09c413559b4a0699a
- SSDEEP 96:tDtjUqnbMpClJbWvm75q5vUh2m/OeW5v3N5n5vdRFOYhbV:tD1UqnbMpCl1Wvm70uh2m0lNxf/O+V
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app/node_modules/concat-stream/index.js
- Size 3KB
- SHA256 e222de1bad715d49d3e50421e0a06699f4fe9441de5f476f902d92999c1c1db5
- MD5 034c9df386eba98656ba49ce8f42f79f
- SHA1 a3a566932f622c73e2f15a3760e7a471376eb3bd
- SHA512 863310b54093989957463a97e6809df2a23f7156f3739da01275500d0a587ce0ac9d5e10c7d2ecff69e69b2e4d0fbf75e13f4d2f76fef5d954dba43551190b1b
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app/node_modules/conf/dist/source/index.js
- Size 20KB
- SHA256 bb9f43d6800ae8a54239dffdb4d8bf9532a3620454d2195762e91daf4303e586
- MD5 34d201fe1dd54fdbc87bf1a23bc971ef
- SHA1 57e6d3f4a52aceda042ce9e05b1c117381c4c0d1
- SHA512 3f938ae1db6f88d7f4ea8c6594b6062cb35fd9f2b816181e1742a014eb017346071826bf7bf33c09517130f8be2c1fa97a048e8572337b09237d748e3138504c
- SSDEEP 192:sHLik7ZW7JeorxR6CzQ8tN5R9DwCyUoZk+x9tCW3ZNtV4n0iLfQ49JJt4yuuO0XF:8wJew9b+xuIhlpS5t4m0hw8ljcgKgYF
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32