General

  • Target

    meth2.elf

  • Size

    49KB

  • Sample

    250114-ql8vzs1lhk

  • MD5

    3cd4c06f316a9414d46278cec0057df2

  • SHA1

    3e195cb5c3270af4ed4bc7856924f8a43427afeb

  • SHA256

    504eb40189921f74d9e7043632097025ebdecc6829469327cea12822f49a082b

  • SHA512

    009bcaaf62aeac8226c8c2315765f30c3464a9c7f743b51e0774e172765b1bc1711cdae101bbfd50b5d6f0bbe0633837284aeabdbd935eaf28f240ac5623d797

  • SSDEEP

    1536:z2Cjz+rGHUo+iwYRkCwchfD1oPtAFQPfkq:Vj6iHUmwYqk1oPtjfk

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

Targets

    • Target

      meth2.elf

    • Size

      49KB

    • MD5

      3cd4c06f316a9414d46278cec0057df2

    • SHA1

      3e195cb5c3270af4ed4bc7856924f8a43427afeb

    • SHA256

      504eb40189921f74d9e7043632097025ebdecc6829469327cea12822f49a082b

    • SHA512

      009bcaaf62aeac8226c8c2315765f30c3464a9c7f743b51e0774e172765b1bc1711cdae101bbfd50b5d6f0bbe0633837284aeabdbd935eaf28f240ac5623d797

    • SSDEEP

      1536:z2Cjz+rGHUo+iwYRkCwchfD1oPtAFQPfkq:Vj6iHUmwYqk1oPtjfk

    • Contacts a large (113615) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

MITRE ATT&CK Enterprise v15

Tasks