General

  • Target

    wind.x86.elf

  • Size

    25KB

  • Sample

    250102-3fd5mssrdm

  • MD5

    819856ae59567a9a45f09a578a8701d6

  • SHA1

    f10479dba7d8ce69c749bd30461ba4a1e0a75833

  • SHA256

    f1eb1a307496e1f0468c7a40e8b64d35e0052d9d1654d4a06b444c8218f9be38

  • SHA512

    10223b4bb6d324eeb9d3d0313e4d16b31dbd4111fb0f9c5b5319e539277c0d05dcf67ac802b9c45fbb7248884370cc0ff0855547e5e39b8930aab2e8105090cb

  • SSDEEP

    768:oyIWAEAOn2fvESB7DXY9WtwHbK+/AoXZUs6:o0pnUsSB7DXRtwdZm

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      wind.x86.elf

    • Size

      25KB

    • MD5

      819856ae59567a9a45f09a578a8701d6

    • SHA1

      f10479dba7d8ce69c749bd30461ba4a1e0a75833

    • SHA256

      f1eb1a307496e1f0468c7a40e8b64d35e0052d9d1654d4a06b444c8218f9be38

    • SHA512

      10223b4bb6d324eeb9d3d0313e4d16b31dbd4111fb0f9c5b5319e539277c0d05dcf67ac802b9c45fbb7248884370cc0ff0855547e5e39b8930aab2e8105090cb

    • SSDEEP

      768:oyIWAEAOn2fvESB7DXY9WtwHbK+/AoXZUs6:o0pnUsSB7DXRtwdZm

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Mirai family

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks