Overview

overview

10

Static

static

1

nz.sh

ubuntu-18.04-amd64

10

nz.sh

debian-9-armhf

10

nz.sh

debian-9-mips

10

nz.sh

debian-9-mipsel

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    nz.sh
  • Size 2KB
  • Sample260629-yt61cset3x
  • SHA256 616cd18e35620b82d680158d498e00c5e601190c9c28c452915f73465ad6b354
  • MD5 SHA1 SHA512 TLSH
Score
10/10
miraiantivmbotnetdefense_evasiondiscoverylinux

Malware Config

Extracted

Family

  • mirai

C2

  • menherabotnet.p-e.kr

Extracted

Family

  • mirai

C2

  • menherabotnet.p-e.kr

Extracted

Family

  • mirai

C2

  • menherabotnet.p-e.kr

Extracted

Family

  • mirai

C2

  • menherabotnet.p-e.kr

Targets

    • Target
      nz.sh
    • Size 2KB
    • SHA256 616cd18e35620b82d680158d498e00c5e601190c9c28c452915f73465ad6b354
    • MD5 SHA1 SHA512 TLSH
    Score
    10/10
    botnetdefense_evasiondiscoverymiraiantivm

    • Family: Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

      defense_evasion

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v16

Tasks