General

  • Target

    652-1-0x00008000-0x00025990-memory.dmp

  • Size

    76KB

  • Sample

    241226-1a82qa1mbq

  • MD5

    0417e943c7c4b715a9542d487ff2a8a6

  • SHA1

    68651f10c97bec0bf0a6959f3d0b7e127de43a62

  • SHA256

    8e460ed622c72b5cdca4f7b0435aa1124cfb2ce31bb2960482377c2e17113d3b

  • SHA512

    2847601346ab07b891acc0a5137ea16361e6b2fc493e9c3592756573ab9342325d03ca4ab63922542e3ec7f7dd29aded595c95129891512698a4e8ad8cb1e5b5

  • SSDEEP

    1536:FB/VU93ilj19ZBpCO72Rbu1U+qhxp8f8vN97:FB/VBBpCO72RDRZN97

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      652-1-0x00008000-0x00025990-memory.dmp

    • Size

      76KB

    • MD5

      0417e943c7c4b715a9542d487ff2a8a6

    • SHA1

      68651f10c97bec0bf0a6959f3d0b7e127de43a62

    • SHA256

      8e460ed622c72b5cdca4f7b0435aa1124cfb2ce31bb2960482377c2e17113d3b

    • SHA512

      2847601346ab07b891acc0a5137ea16361e6b2fc493e9c3592756573ab9342325d03ca4ab63922542e3ec7f7dd29aded595c95129891512698a4e8ad8cb1e5b5

    • SSDEEP

      1536:FB/VU93ilj19ZBpCO72Rbu1U+qhxp8f8vN97:FB/VBBpCO72RDRZN97

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks