General

  • Target

    mips.elf

  • Size

    78KB

  • Sample

    250128-3cj7gstqg1

  • MD5

    81f2aa54da6d07a326356455c35bb902

  • SHA1

    e2023381239f1ae66ed80e9e5d6b82eca40eb8c4

  • SHA256

    ea949cb845eb3692afa03a16ada0d5785f6ad30bdcf94567e02176aa9de7f75b

  • SHA512

    5c678984682361373753b2c784cba99ba04f8aff4455402fb8af736743997688ce34dc6dd8b8a0e596c469eb0bce58f5a090954f76880662e50da94351f0f563

  • SSDEEP

    1536:q+XjfupiLLwEuTjpUcnD4FZ0vEyvNq26/UKFu5L/2Nd42+pH:q+LupnEmCOD4F+vEOq26/UKFute/yH

Malware Config

Extracted

Family

mirai

Botnet

KURC

Targets

    • Target

      mips.elf

    • Size

      78KB

    • MD5

      81f2aa54da6d07a326356455c35bb902

    • SHA1

      e2023381239f1ae66ed80e9e5d6b82eca40eb8c4

    • SHA256

      ea949cb845eb3692afa03a16ada0d5785f6ad30bdcf94567e02176aa9de7f75b

    • SHA512

      5c678984682361373753b2c784cba99ba04f8aff4455402fb8af736743997688ce34dc6dd8b8a0e596c469eb0bce58f5a090954f76880662e50da94351f0f563

    • SSDEEP

      1536:q+XjfupiLLwEuTjpUcnD4FZ0vEyvNq26/UKFu5L/2Nd42+pH:q+LupnEmCOD4F+vEOq26/UKFute/yH

    • Contacts a large (115713) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks