General

  • Target

    mips.elf

  • Size

    82KB

  • Sample

    250323-dcr5na1ps4

  • MD5

    7f3a7052000e43a7ea7b3831d3471c53

  • SHA1

    ea0f5ad61681af067cd5c8a6c1fe9f8df20e7fb0

  • SHA256

    740e42e867d99cdcdc6e3905156543ac4463f26a20a87cefa21907ffa926fd27

  • SHA512

    a93e9477a07d66ea950b8cceba5b9953fb9266606cee61ec8d8dbe854f276b0a8df85ae5f80fb738cb0f3a8f7c322e2953757e392443fba6b85adcd14c602e28

  • SSDEEP

    1536:gK2YOvvHQ8krvdTHCqDYNwq70JIz2kOAERkeh7Dgb:b29vvw88VfDYNR70JIzTDEfDgb

Malware Config

Extracted

Family

mirai

Botnet

WICKED

Targets

    • Target

      mips.elf

    • Size

      82KB

    • MD5

      7f3a7052000e43a7ea7b3831d3471c53

    • SHA1

      ea0f5ad61681af067cd5c8a6c1fe9f8df20e7fb0

    • SHA256

      740e42e867d99cdcdc6e3905156543ac4463f26a20a87cefa21907ffa926fd27

    • SHA512

      a93e9477a07d66ea950b8cceba5b9953fb9266606cee61ec8d8dbe854f276b0a8df85ae5f80fb738cb0f3a8f7c322e2953757e392443fba6b85adcd14c602e28

    • SSDEEP

      1536:gK2YOvvHQ8krvdTHCqDYNwq70JIz2kOAERkeh7Dgb:b29vvw88VfDYNR70JIzTDEfDgb

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Reads process memory

      Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

MITRE ATT&CK Enterprise v15

Tasks