General

  • Target
    x86_64.uhavenobotsxd.elf
  • Size 90KB
  • Sample251222-ekx7bady8f
  • SHA256 ea95889e1be7ae3975562b861493eb7ee6d2ef2e01b5d2960b52cd53305db4a3
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Targets

    • Target
      x86_64.uhavenobotsxd.elf
    • Size 90KB
    • SHA256 ea95889e1be7ae3975562b861493eb7ee6d2ef2e01b5d2960b52cd53305db4a3
    • MD5 SHA1 SHA512 SSDEEP
    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Mirai family

    • Executes dropped EXE

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Creates/modifies environment variables

      Creating/modifying environment variables is a common persistence mechanism.

    • Deletes log files

      Deletes log files on the system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

    • Modifies rc script

      Adding/modifying system rc scripts is a common persistence mechanism.

    • Write file to user bin folder

    • Modifies Bash startup script

MITRE ATT&CK Enterprise v16

Tasks