General
- Target mips.uhavenobotsxd.elf
- Size 112KB
- Sample251121-3wvsbshm2v
- SHA256 76dfc221cf91c3e2b850dcd4c39c191164048cbbf615a34a58ca375442a6807a
- MD5 3ff9727b8833a052d0c51c4666352319
- SHA1 775a24eb3b973e316f1d3a4f1ec4e31564659fee
- SHA512 e14bc19d7a9f08aec43c76d7de307ac9a1683cd634336f53a252dc5f2bc7e8f0c7e4bf4031415bb89aee263e2cc8b0f638f55732be6224c5be3859b5b404315d
- SSDEEP 1536:0XDeFSViYFSiEIf4oIKYtwLZC2cX1VHU2mEyo7e2h3KC2IKemHP:ED2JYFSef4oIK5LwvlVHU2m/a32lP
- MD5 SHA1 SHA512 SSDEEP
Behavioral task
behavioral1
Sample
mips.uhavenobotsxd.elf
Resource
debian9-mipsbe-20250619-en
Malware Config
Targets
-
- Target mips.uhavenobotsxd.elf
- Size 112KB
- SHA256 76dfc221cf91c3e2b850dcd4c39c191164048cbbf615a34a58ca375442a6807a
- MD5 3ff9727b8833a052d0c51c4666352319
- SHA1 775a24eb3b973e316f1d3a4f1ec4e31564659fee
- SHA512 e14bc19d7a9f08aec43c76d7de307ac9a1683cd634336f53a252dc5f2bc7e8f0c7e4bf4031415bb89aee263e2cc8b0f638f55732be6224c5be3859b5b404315d
- SSDEEP 1536:0XDeFSViYFSiEIf4oIKYtwLZC2cX1VHU2mEyo7e2h3KC2IKemHP:ED2JYFSef4oIK5LwvlVHU2m/a32lP
- MD5 SHA1 SHA512 SSDEEP
-
Mirai family
-
Executes dropped EXE
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Write file to user bin folder
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Boot or Logon Initialization Scripts
2RC Scripts
2Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
3Boot or Logon Initialization Scripts
2RC Scripts
2Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1