General

  • Target

    x86_64.elf

  • Size

    61KB

  • Sample

    250128-wjky2azldp

  • MD5

    d106207e1c5f1800a76b686eeb4e6a2e

  • SHA1

    685c4a9ff03085cc86ad09463aaafe792f85c65e

  • SHA256

    abae7d7fc17d80162c1dea23b1d65a68537d2afed8774b7341b55cb3e4c09541

  • SHA512

    49d6142ce412e7b1fbd811586cd93bbb3066b2b708af2761dda59009982d4b9a13804962a026ad1a4e5b9fb4c70045b14858fd58d622002e5e0b388ea3d37734

  • SSDEEP

    1536:VcCUDpjc+wiDl2QlrRaBssPnemtTnGsb92zW3OGJsJm:CCUFjxwiZ2QdRa6sPjdnf2zWeosJ

Malware Config

Extracted

Family

mirai

Botnet

KURC

Targets

    • Target

      x86_64.elf

    • Size

      61KB

    • MD5

      d106207e1c5f1800a76b686eeb4e6a2e

    • SHA1

      685c4a9ff03085cc86ad09463aaafe792f85c65e

    • SHA256

      abae7d7fc17d80162c1dea23b1d65a68537d2afed8774b7341b55cb3e4c09541

    • SHA512

      49d6142ce412e7b1fbd811586cd93bbb3066b2b708af2761dda59009982d4b9a13804962a026ad1a4e5b9fb4c70045b14858fd58d622002e5e0b388ea3d37734

    • SSDEEP

      1536:VcCUDpjc+wiDl2QlrRaBssPnemtTnGsb92zW3OGJsJm:CCUFjxwiZ2QdRa6sPjdnf2zWeosJ

    • Contacts a large (116577) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks