General

  • Target

    pmips.elf

  • Size

    35KB

  • Sample

    250414-yhzrxazkt2

  • MD5

    8edab3f54e0d07d07f4a2c78b58f6aee

  • SHA1

    a9d4104ead918423519e7dcf6971ee32ffc42569

  • SHA256

    61148d244ab002d5fc0382b84c40ddb0c6801e3feefe5bd68d22fff0bcb39dcf

  • SHA512

    95eb842d297d80f2e116e650e4a62c45c5aa7c0863bdf43401d2bc8915bdfac06d97b16ee2d3c11c3219fd8187bb66195c5eb24f39cd44ad1a3a42d5961a1e30

  • SSDEEP

    768:ylWqYyhCL7njgXf9ZWlFbNKlgwYS2PEVbqehfJgGlzDpbuR1JQIK:Jq+Ljj6ZtYS2sVueLVJueIK

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Targets

    • Target

      pmips.elf

    • Size

      35KB

    • MD5

      8edab3f54e0d07d07f4a2c78b58f6aee

    • SHA1

      a9d4104ead918423519e7dcf6971ee32ffc42569

    • SHA256

      61148d244ab002d5fc0382b84c40ddb0c6801e3feefe5bd68d22fff0bcb39dcf

    • SHA512

      95eb842d297d80f2e116e650e4a62c45c5aa7c0863bdf43401d2bc8915bdfac06d97b16ee2d3c11c3219fd8187bb66195c5eb24f39cd44ad1a3a42d5961a1e30

    • SSDEEP

      768:ylWqYyhCL7njgXf9ZWlFbNKlgwYS2PEVbqehfJgGlzDpbuR1JQIK:Jq+Ljj6ZtYS2sVueLVJueIK

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Mirai family

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

MITRE ATT&CK Enterprise v16

Tasks