General

  • Target
    mips.uhavenobotsxd.elf
  • Size 128KB
  • Sample260102-hs1h7adn4y
  • SHA256 10e88373c3fba576754ff519a7d294bbbe66334f3aaf49441e4c954dca8a3dda
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Targets

    • Target
      mips.uhavenobotsxd.elf
    • Size 128KB
    • SHA256 10e88373c3fba576754ff519a7d294bbbe66334f3aaf49441e4c954dca8a3dda
    • MD5 SHA1 SHA512 SSDEEP
    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

    • Mirai family

    • Executes dropped EXE

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Creates/modifies environment variables

      Creating/modifying environment variables is a common persistence mechanism.

    • Deletes log files

      Deletes log files on the system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

    • Modifies rc script

      Adding/modifying system rc scripts is a common persistence mechanism.

    • Write file to user bin folder

    • Modifies Bash startup script

MITRE ATT&CK Enterprise v16

Tasks