mirai | 71199b3059c1d2827564f82c1771f7b98202d3ce317f5c0eb4f3848cd7578830 | Triage

Sharing

General

Target

71199b3059c1d2827564f82c1771f7b98202d3ce317f5c0eb4f3848cd7578830.elf
Size

86KB
Sample

250202-e3p9esvqhy
MD5

00135a53766f25f34bb85181008ecf41
SHA1

0f777713a895f17514a21da8309134336687511b
SHA256

71199b3059c1d2827564f82c1771f7b98202d3ce317f5c0eb4f3848cd7578830
SHA512

4244e517efedef31435d45eb6e7acc50a8bab7e4b6a80d78d36b135b3fdce953c9fcb7d439ab549ab0ad11ef3b8563000989e33ae7ef83521b46c0f78a7f022c
SSDEEP

1536:RVATWllAKn1c/s9p3ikTIFn0p5z3nKZGilZE:RmTWllAI1cmp3nK

Score

10^/10

mirai credential_access defense_evasion

Malware Config

Targets

- Target
  
  71199b3059c1d2827564f82c1771f7b98202d3ce317f5c0eb4f3848cd7578830.elf
- Size
  
  86KB
- MD5
  
  00135a53766f25f34bb85181008ecf41
- SHA1
  
  0f777713a895f17514a21da8309134336687511b
- SHA256
  
  71199b3059c1d2827564f82c1771f7b98202d3ce317f5c0eb4f3848cd7578830
- SHA512
  
  4244e517efedef31435d45eb6e7acc50a8bab7e4b6a80d78d36b135b3fdce953c9fcb7d439ab549ab0ad11ef3b8563000989e33ae7ef83521b46c0f78a7f022c
- SSDEEP
  
  1536:RVATWllAKn1c/s9p3ikTIFn0p5z3nKZGilZE:RmTWllAI1cmp3nK
Score

7^/10

credential_access defense_evasion
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Reads process memory
  Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
  credential_access
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Credential Access

OS Credential Dumping

Proc Filesystem

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

credential_accessdefense_evasion