General

  • Target

    20e0fb1af9aa7d0d162087ad61db439f690706019daa13c7998742bff28c4799.elf

  • Size

    33KB

  • Sample

    250106-cpzjtssnh1

  • MD5

    0af8e9a039db17a95d08308e2a7aa389

  • SHA1

    f9460ece1c3eacf30340d1cdcb59ad14c97857d2

  • SHA256

    20e0fb1af9aa7d0d162087ad61db439f690706019daa13c7998742bff28c4799

  • SHA512

    32647e73ba5ad1d30e1a89862fe0a65d70b2ea880a9bda46ff3e2df6c4d9168d2bb8e7f24cdd170337047532b79fbfc1cf9b3b5e1d0ba693e78a33e936529c87

  • SSDEEP

    768:A4hu8Ute74oKXH+xiTzAnuoTy0NEwWPc6XLjWMdx:AaUtRoKXexiTz9oTy0SwcJH

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

Targets

    • Target

      20e0fb1af9aa7d0d162087ad61db439f690706019daa13c7998742bff28c4799.elf

    • Size

      33KB

    • MD5

      0af8e9a039db17a95d08308e2a7aa389

    • SHA1

      f9460ece1c3eacf30340d1cdcb59ad14c97857d2

    • SHA256

      20e0fb1af9aa7d0d162087ad61db439f690706019daa13c7998742bff28c4799

    • SHA512

      32647e73ba5ad1d30e1a89862fe0a65d70b2ea880a9bda46ff3e2df6c4d9168d2bb8e7f24cdd170337047532b79fbfc1cf9b3b5e1d0ba693e78a33e936529c87

    • SSDEEP

      768:A4hu8Ute74oKXH+xiTzAnuoTy0NEwWPc6XLjWMdx:AaUtRoKXexiTz9oTy0SwcJH

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Mirai family

    • Contacts a large (150261) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks