General
- Target e30c68a5d14048c44c94676561a0fa2d15bc2fc205daad34da42ac3ee8c263ca
- Size 61KB
- Sample260807-th18hs1zez
- SHA256 e30c68a5d14048c44c94676561a0fa2d15bc2fc205daad34da42ac3ee8c263ca
Score
10/10
Malware Config
Targets
-
- Target e30c68a5d14048c44c94676561a0fa2d15bc2fc205daad34da42ac3ee8c263ca
- Size 61KB
- SHA256 e30c68a5d14048c44c94676561a0fa2d15bc2fc205daad34da42ac3ee8c263ca
Score10/10-
Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Deletes Audit logs
Deletes logs related to the Linux Audit framework.
-
Deletes journal logs
Deletes systemd journal logs. Likely to evade detection.
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Write file to user bin folder
-
Writes file to system bin folder
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Privilege Escalation
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1