General

  • Target

    debug.dbg.elf

  • Size

    69KB

  • Sample

    250203-metwpszpfk

  • MD5

    4f0598b31324cdbb14b54d10de2c29c5

  • SHA1

    4c247bcbe0bbd73ca77f3fbd0462a2a5bc11493c

  • SHA256

    0c3e585f6044a14b96441f88c42e2d09bd71e82724db5b981876a1d1dda17d74

  • SHA512

    2c1aee0abba26f280166a7977a035f8621450fd2a544c6805792b9e6634c71fcf23812243cabca6bdb836b8dc865270a85a7103ab7e2ddf83124912095333cef

  • SSDEEP

    1536:V5IWM3pufm+dOnBi+Z9XI3tPJfhI9/XZE+OjEHedVOJw1qE:V5Ix3pufvdOHwPJpA/XZExjE+eJX

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

C2

srv.vlrt-gap.com

Targets

    • Target

      debug.dbg.elf

    • Size

      69KB

    • MD5

      4f0598b31324cdbb14b54d10de2c29c5

    • SHA1

      4c247bcbe0bbd73ca77f3fbd0462a2a5bc11493c

    • SHA256

      0c3e585f6044a14b96441f88c42e2d09bd71e82724db5b981876a1d1dda17d74

    • SHA512

      2c1aee0abba26f280166a7977a035f8621450fd2a544c6805792b9e6634c71fcf23812243cabca6bdb836b8dc865270a85a7103ab7e2ddf83124912095333cef

    • SSDEEP

      1536:V5IWM3pufm+dOnBi+Z9XI3tPJfhI9/XZE+OjEHedVOJw1qE:V5Ix3pufvdOHwPJpA/XZExjE+eJX

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks