General

  • Target

    60f7fc62b760c105480589c7219290c4778c85520f5e1f6e0f654656989f9cdb.elf

  • Size

    128KB

  • Sample

    241231-cy1s9azjfq

  • MD5

    e1fbfe1054d3fa3e6d193c60670427b8

  • SHA1

    d1b7c7f9169f7d34b7b219cb70e512a07dbded88

  • SHA256

    60f7fc62b760c105480589c7219290c4778c85520f5e1f6e0f654656989f9cdb

  • SHA512

    595083014a6e15cec0f72838eea47b5beadc20997d65d39c6e331724dc9286095a8668022d0836fff769477f8b265ac10a5067826594768bc220bce456b82843

  • SSDEEP

    3072:4MHPScueW1szdNsSHfFBCYKqKweQS1j6VM/9sMmywPoIlq:4MHPScnKsXsSHfFBvKYpS1AM/9sMmyw4

Malware Config

Extracted

Family

mirai

Botnet

CONDI

C2

botnet.tfmobile.store

Targets

    • Target

      60f7fc62b760c105480589c7219290c4778c85520f5e1f6e0f654656989f9cdb.elf

    • Size

      128KB

    • MD5

      e1fbfe1054d3fa3e6d193c60670427b8

    • SHA1

      d1b7c7f9169f7d34b7b219cb70e512a07dbded88

    • SHA256

      60f7fc62b760c105480589c7219290c4778c85520f5e1f6e0f654656989f9cdb

    • SHA512

      595083014a6e15cec0f72838eea47b5beadc20997d65d39c6e331724dc9286095a8668022d0836fff769477f8b265ac10a5067826594768bc220bce456b82843

    • SSDEEP

      3072:4MHPScueW1szdNsSHfFBCYKqKweQS1j6VM/9sMmywPoIlq:4MHPScnKsXsSHfFBvKYpS1AM/9sMmyw4

    • Contacts a large (54125) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks