General

  • Target

    mirai.x86

  • Size

    54KB

  • Sample

    240702-ka5fjaxgnk

  • MD5

    c8d03328fa2d2d10800b9b31b52c0b45

  • SHA1

    cbcc393fcb8a6c355aebb6e727b849d0d2621ed7

  • SHA256

    0d1c0c547ff6ad0d5e649eb3e7c0354136ee19841c6a7efba4d2a90597260bdf

  • SHA512

    c88c9625ed658f4ec2300058e9729f0304201ae54e360fbe0f3f2718d77d52974736d4bb3d618d31e35459c4d297f8d0518c7e29c96eae31a95a5c24f94963bd

  • SSDEEP

    1536:36Ew7hWCbZ6OzptrGP85wXypWTF+bt+Rc:C1W4Z6OzP4NXypWp+bQK

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Targets

    • Target

      mirai.x86

    • Size

      54KB

    • MD5

      c8d03328fa2d2d10800b9b31b52c0b45

    • SHA1

      cbcc393fcb8a6c355aebb6e727b849d0d2621ed7

    • SHA256

      0d1c0c547ff6ad0d5e649eb3e7c0354136ee19841c6a7efba4d2a90597260bdf

    • SHA512

      c88c9625ed658f4ec2300058e9729f0304201ae54e360fbe0f3f2718d77d52974736d4bb3d618d31e35459c4d297f8d0518c7e29c96eae31a95a5c24f94963bd

    • SSDEEP

      1536:36Ew7hWCbZ6OzptrGP85wXypWTF+bt+Rc:C1W4Z6OzP4NXypWp+bQK

    Score
    9/10
    • Contacts a large (3038) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Impair Defenses

1
T1562

Discovery

Network Service Discovery

1
T1046

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Tasks