General

  • Target

    ef3f31f9e7e7d8b0b3eddb701a63f1075e772764f91781fb1e69ba9ef93489ed.elf

  • Size

    51KB

  • Sample

    250116-d9fswsznb1

  • MD5

    37c785a28205364051fd60f400cdeef5

  • SHA1

    4b41f55b1ec03fe5a5a3e98f3f0c4b6860c0cd17

  • SHA256

    ef3f31f9e7e7d8b0b3eddb701a63f1075e772764f91781fb1e69ba9ef93489ed

  • SHA512

    5ba04ab5c5e5ae4ca9dae4c851b013c900ad6097472cfd305d35eca598487b8e0047ad63820b5d6e8916e6841f6597931794897e3acdd19ea09acaee065dcda7

  • SSDEEP

    768:j0QDd8eakzD4lR+YOANqN+QUV0Fji9iooxn5ZkHPLSxMzh6I/5/NPsB2gGVzJ:Vd5atOAN9RV0FW9iN5ZkvmC9KBIt

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

Targets

    • Target

      ef3f31f9e7e7d8b0b3eddb701a63f1075e772764f91781fb1e69ba9ef93489ed.elf

    • Size

      51KB

    • MD5

      37c785a28205364051fd60f400cdeef5

    • SHA1

      4b41f55b1ec03fe5a5a3e98f3f0c4b6860c0cd17

    • SHA256

      ef3f31f9e7e7d8b0b3eddb701a63f1075e772764f91781fb1e69ba9ef93489ed

    • SHA512

      5ba04ab5c5e5ae4ca9dae4c851b013c900ad6097472cfd305d35eca598487b8e0047ad63820b5d6e8916e6841f6597931794897e3acdd19ea09acaee065dcda7

    • SSDEEP

      768:j0QDd8eakzD4lR+YOANqN+QUV0Fji9iooxn5ZkHPLSxMzh6I/5/NPsB2gGVzJ:Vd5atOAN9RV0FW9iN5ZkvmC9KBIt

    • Contacts a large (113103) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

MITRE ATT&CK Enterprise v15

Tasks