General

  • Target

    2f86cef4a796d5a6f44faa45a99fcd4d1626cfa532ca42140a26d5492db5aa5d.elf

  • Size

    36KB

  • Sample

    250108-cmw1xs1phn

  • MD5

    9650ea1e75146d6179d7a49b142312a4

  • SHA1

    e41ebfa59738bfe7d8c53001b5f4d1f56c64ab76

  • SHA256

    2f86cef4a796d5a6f44faa45a99fcd4d1626cfa532ca42140a26d5492db5aa5d

  • SHA512

    4128b963191bb4e673f97865c6a934491f4972461f61b326ceb1e64c2a667548f70a9c77dba48fdebc08bce9406afdd135e585c34ab12ba4d1b05a79979a0893

  • SSDEEP

    768:PbM1A1wkVghxAHEAPHHAscLHuAEE4Ie1eDIyxU/JgGlzDpUYsi:PuIwGfEhLHug4NLyxqVqYB

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

C2

raw.igxhost.ru

Targets

    • Target

      2f86cef4a796d5a6f44faa45a99fcd4d1626cfa532ca42140a26d5492db5aa5d.elf

    • Size

      36KB

    • MD5

      9650ea1e75146d6179d7a49b142312a4

    • SHA1

      e41ebfa59738bfe7d8c53001b5f4d1f56c64ab76

    • SHA256

      2f86cef4a796d5a6f44faa45a99fcd4d1626cfa532ca42140a26d5492db5aa5d

    • SHA512

      4128b963191bb4e673f97865c6a934491f4972461f61b326ceb1e64c2a667548f70a9c77dba48fdebc08bce9406afdd135e585c34ab12ba4d1b05a79979a0893

    • SSDEEP

      768:PbM1A1wkVghxAHEAPHHAscLHuAEE4Ie1eDIyxU/JgGlzDpUYsi:PuIwGfEhLHug4NLyxqVqYB

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Mirai family

    • Contacts a large (23668) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

MITRE ATT&CK Enterprise v15

Tasks