Overview

overview

10

Static

static

5

a12a652ea4...e1.elf

debian-9-mips

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a12a652ea4f8387cbe7fd08a21e06c9a8e97bb50d67497953804eaaebb6b9ce1.elf

  • Size

    50KB

  • Sample

    250307-ge2nnawkt3

  • MD5

    18e4155f478e339821a4f95b79a18a2c

  • SHA1

    be8c4c1cf1d1fb0447f49c1b50f621c8bf32d86b

  • SHA256

    a12a652ea4f8387cbe7fd08a21e06c9a8e97bb50d67497953804eaaebb6b9ce1

  • SHA512

    b5bcd9a02f5c07bd6637887e9baa67f10609c31f7888127dee01eee544832fc43580f0ad36b3f7904904a0c53410b47f296d9e0064ab9e99f7b845368258a9d3

  • SSDEEP

    1536:YAsadXrYZk8ATnYcEC8toIj14vW4mVJuq:pprbTnYvC8tom4O4mVQq

Score
10/10
miraibotnetdefense_evasiondiscoveryupx

Malware Config

Targets

    • Target

      a12a652ea4f8387cbe7fd08a21e06c9a8e97bb50d67497953804eaaebb6b9ce1.elf

    • Size

      50KB

    • MD5

      18e4155f478e339821a4f95b79a18a2c

    • SHA1

      be8c4c1cf1d1fb0447f49c1b50f621c8bf32d86b

    • SHA256

      a12a652ea4f8387cbe7fd08a21e06c9a8e97bb50d67497953804eaaebb6b9ce1

    • SHA512

      b5bcd9a02f5c07bd6637887e9baa67f10609c31f7888127dee01eee544832fc43580f0ad36b3f7904904a0c53410b47f296d9e0064ab9e99f7b845368258a9d3

    • SSDEEP

      1536:YAsadXrYZk8ATnYcEC8toIj14vW4mVJuq:pprbTnYvC8tom4O4mVQq

    Score
    10/10
    miraibotnetdefense_evasiondiscovery

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Mirai family

      mirai

    • Contacts a large (19301) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks