Overview

overview

10

Static

static

10

0d1c0c547f...df.elf

ubuntu-22.04-amd64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0d1c0c547ff6ad0d5e649eb3e7c0354136ee19841c6a7efba4d2a90597260bdf.elf

  • Size

    54KB

  • Sample

    240703-be9flstclp

  • MD5

    c8d03328fa2d2d10800b9b31b52c0b45

  • SHA1

    cbcc393fcb8a6c355aebb6e727b849d0d2621ed7

  • SHA256

    0d1c0c547ff6ad0d5e649eb3e7c0354136ee19841c6a7efba4d2a90597260bdf

  • SHA512

    c88c9625ed658f4ec2300058e9729f0304201ae54e360fbe0f3f2718d77d52974736d4bb3d618d31e35459c4d297f8d0518c7e29c96eae31a95a5c24f94963bd

  • SSDEEP

    1536:36Ew7hWCbZ6OzptrGP85wXypWTF+bt+Rc:C1W4Z6OzP4NXypWp+bQK

Score
10/10
miraimiraidiscoverylinux

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Targets

    • Target

      0d1c0c547ff6ad0d5e649eb3e7c0354136ee19841c6a7efba4d2a90597260bdf.elf

    • Size

      54KB

    • MD5

      c8d03328fa2d2d10800b9b31b52c0b45

    • SHA1

      cbcc393fcb8a6c355aebb6e727b849d0d2621ed7

    • SHA256

      0d1c0c547ff6ad0d5e649eb3e7c0354136ee19841c6a7efba4d2a90597260bdf

    • SHA512

      c88c9625ed658f4ec2300058e9729f0304201ae54e360fbe0f3f2718d77d52974736d4bb3d618d31e35459c4d297f8d0518c7e29c96eae31a95a5c24f94963bd

    • SSDEEP

      1536:36Ew7hWCbZ6OzptrGP85wXypWTF+bt+Rc:C1W4Z6OzP4NXypWp+bQK

    Score
    9/10
    discovery

    • Contacts a large (11831) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Network Service Discovery

2
T1046

System Network Connections Discovery

1
T1049

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks