General
- Target morte.i686
- Size 77KB
- Sample261007-w57d6ac16t
- SHA256 0b667fe4fc990f75d0ff341a3a8c0a6a8939006cbf74d1250e536dcaa020e262
Malware Config
Targets
-
- Target morte.i686
- Size 77KB
- SHA256 0b667fe4fc990f75d0ff341a3a8c0a6a8939006cbf74d1250e536dcaa020e262
Score10/10-
Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Deletes Audit logs
Deletes logs related to the Linux Audit framework.
-
Deletes journal logs
Deletes systemd journal logs. Likely to evade detection.
-
Deletes system logs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Checks SCSI settings
Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies rc script
Adding/modifying system rc scripts is a common persistence mechanism.
-
Writes file to system bin folder
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Defense Evasion
Indicator Removal
3Clear Linux or Mac System Logs
3Virtualization/Sandbox Evasion
2System Checks
2