mirai | b637ba3f59deed6073a25cd285a6b704d97993c9e75c66f6816907f1b29c8853 | Triage

Sharing

General

Target

JaffaCakes118_0220e6363be9a4cafbbad5b464ff89f5
Size

66KB
Sample

241231-dplteavje1
MD5

0220e6363be9a4cafbbad5b464ff89f5
SHA1

d4a287703585beae662688cdc5f5640f0a135f17
SHA256

b637ba3f59deed6073a25cd285a6b704d97993c9e75c66f6816907f1b29c8853
SHA512

597a9139fb36ea555a8d133a8776ea86cadaaa5aab80b205e508e12c81a62521f883da84925920c2f9c8cc22b65c6dbe9ae9abb0019b7e10773285849e869f01
SSDEEP

1536:dE8aCKgy6jLIjta3stGjp4pTfdXy0/fxJnU67JL:RHBUJa3PSpTg0/fxJn/tL

Score

10^/10

mirai defense_evasion discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_0220e6363be9a4cafbbad5b464ff89f5
- Size
  
  66KB
- MD5
  
  0220e6363be9a4cafbbad5b464ff89f5
- SHA1
  
  d4a287703585beae662688cdc5f5640f0a135f17
- SHA256
  
  b637ba3f59deed6073a25cd285a6b704d97993c9e75c66f6816907f1b29c8853
- SHA512
  
  597a9139fb36ea555a8d133a8776ea86cadaaa5aab80b205e508e12c81a62521f883da84925920c2f9c8cc22b65c6dbe9ae9abb0019b7e10773285849e869f01
- SSDEEP
  
  1536:dE8aCKgy6jLIjta3stGjp4pTfdXy0/fxJnU67JL:RHBUJa3PSpTg0/fxJn/tL
Score

7^/10

defense_evasion discovery
- Deletes itself
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscovery