General

  • Target

    714-1-0x00400000-0x00458c68-memory.dmp

  • Size

    90KB

  • Sample

    241227-jmsf3atkel

  • MD5

    6b506fedb70cd772b431ba45faa33835

  • SHA1

    3332ed90ef8ee66b3e9281b11583f801af2d8998

  • SHA256

    399d672401d9a2cc0bc3d9f5af21ae6e8d7f2131bab3425438d2013931e4c71a

  • SHA512

    ad79b7e5008ea03557387ce727982d178f7a2185b80601eefedc89db205e8cac53b646c107f44e39a1f58db80b71fc4aded96c9b186be66eadd607362572e3b5

  • SSDEEP

    1536:THdTB6USWdd5WSENTISC6BlwBvsqYvK0e+GczD:LdMYddUoslwqqYvKDczD

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      714-1-0x00400000-0x00458c68-memory.dmp

    • Size

      90KB

    • MD5

      6b506fedb70cd772b431ba45faa33835

    • SHA1

      3332ed90ef8ee66b3e9281b11583f801af2d8998

    • SHA256

      399d672401d9a2cc0bc3d9f5af21ae6e8d7f2131bab3425438d2013931e4c71a

    • SHA512

      ad79b7e5008ea03557387ce727982d178f7a2185b80601eefedc89db205e8cac53b646c107f44e39a1f58db80b71fc4aded96c9b186be66eadd607362572e3b5

    • SSDEEP

      1536:THdTB6USWdd5WSENTISC6BlwBvsqYvK0e+GczD:LdMYddUoslwqqYvKDczD

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks