General

  • Target

    night.mips.elf

  • Size

    31KB

  • Sample

    250124-1yccnaslen

  • MD5

    3b4133dc4e602eccf689c98554016eca

  • SHA1

    41e218f412cf4c5cffc2511201a45cc6eb2322f8

  • SHA256

    235742e3224a335432deb0f29243a8129f718c9b2265aa966488b505feebd182

  • SHA512

    00021df333c791a5747cb98ea6dd07b38fb0d0a91e055f38c5ad0438273e8e75ced91fcb0addac7ac4b13974a310086498fe86817a9396938d26df3f66ed6dfe

  • SSDEEP

    768:CkGVUFmXbht/vrCgNEAXtKWNcuOTl2N6IFGHJgGlzDpbuR1Jg:F0XbveAXtKkOTkN6hFVJum

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Targets

    • Target

      night.mips.elf

    • Size

      31KB

    • MD5

      3b4133dc4e602eccf689c98554016eca

    • SHA1

      41e218f412cf4c5cffc2511201a45cc6eb2322f8

    • SHA256

      235742e3224a335432deb0f29243a8129f718c9b2265aa966488b505feebd182

    • SHA512

      00021df333c791a5747cb98ea6dd07b38fb0d0a91e055f38c5ad0438273e8e75ced91fcb0addac7ac4b13974a310086498fe86817a9396938d26df3f66ed6dfe

    • SSDEEP

      768:CkGVUFmXbht/vrCgNEAXtKWNcuOTl2N6IFGHJgGlzDpbuR1Jg:F0XbveAXtKkOTkN6hFVJum

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Mirai family

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks