General
- Target jaffacakes118_11a211cf5ddd8f6e9b442845a22dc594571ec3c3c476615fdf8918d88d9ef2d2.bin
- Size 47KB
- Sample260910-2q9tmahn8t
- SHA256 11a211cf5ddd8f6e9b442845a22dc594571ec3c3c476615fdf8918d88d9ef2d2
Score
10/10
Malware Config
Targets
-
- Target jaffacakes118_11a211cf5ddd8f6e9b442845a22dc594571ec3c3c476615fdf8918d88d9ef2d2.bin
- Size 47KB
- SHA256 11a211cf5ddd8f6e9b442845a22dc594571ec3c3c476615fdf8918d88d9ef2d2
Score10/10Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
Enumerates running processes
Discovers information about currently running processes on the system
Modifies init.d
Adds/modifies system service, likely for persistence.
Modifies rc script
Adding/modifying system rc scripts is a common persistence mechanism.
Reads process memory
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
2RC Scripts
2Privilege Escalation
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
2RC Scripts
2