mirai | 4ab45e34c0d4e59ed9ee9da871e959bfb9084067dcd7518420d910e817272d95

General

Target
main_mips.elf
Size 243KB
Sample260628-11s37ae15z
SHA256 4ab45e34c0d4e59ed9ee9da871e959bfb9084067dcd7518420d910e817272d95
MD5 1ec58de4f38912433e24aad3822618d0
SHA1 12f09e8a29bc20d07c2a717d2a770cb9a448abb4
SHA512 0f8ae0aef587d58c7506c9e4893da0cb96c55763568ad19fbff1dace54f8a07529eb05ac5f40955147249c0f42a1caf086dbb8b20eca59da823c4fa2ba1b6bcc
SSDEEP 3072:PCk5jbbxCPjNwa9vuWLv+jdBJHXrdN6C4xi9SvdxckMqysqGwqD00:akNbbx/yvzEHHXT//9SVxUlsq5Oh
TLSH
T1BA34D91E2E218F7DF6A9C7B547F74A219B6923D613D2D6C4D2ACD1005E2028E741FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  main_mips.elf
- Size 243KB
- SHA256 4ab45e34c0d4e59ed9ee9da871e959bfb9084067dcd7518420d910e817272d95
- MD5 1ec58de4f38912433e24aad3822618d0
- SHA1 12f09e8a29bc20d07c2a717d2a770cb9a448abb4
- SHA512 0f8ae0aef587d58c7506c9e4893da0cb96c55763568ad19fbff1dace54f8a07529eb05ac5f40955147249c0f42a1caf086dbb8b20eca59da823c4fa2ba1b6bcc
- SSDEEP 3072:PCk5jbbxCPjNwa9vuWLv+jdBJHXrdN6C4xi9SvdxckMqysqGwqD00:akNbbx/yvzEHHXT//9SVxUlsq5Oh
- TLSH
  T1BA34D91E2E218F7DF6A9C7B547F74A219B6923D613D2D6C4D2ACD1005E2028E741FFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

botnet credential_access defense_evasion discovery execution mirai persistence privilege_escalation
- Family: Mirai
  Mirai is a prevalent Linux malware infecting exposed network devices.
  botnet mirai
- Contacts a large (242869) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Deletes itself
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalation
- Creates/modifies environment variables
  Creating/modifying environment variables is a common persistence mechanism.
  persistence privilege_escalation defense_evasion
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
- Modifies rc script
  Adding/modifying system rc scripts is a common persistence mechanism.
  persistence
- Write file to user bin folder
  persistence
- Writes file to system bin folder
- Modifies Bash startup script
  persistence
- Reads process memory
  Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
  credential_access
behavioral1