Extracted

• • Target

    SecuriteInfo.com.Heur.20230430233121085673530.elf

  • Size

    44KB

  • MD5

    ba9442a57c2bd1a80699cc3f2f521f1f

  • SHA1

    0ce2f95e2c7efd238c6c09e1695f16f60880ea06

  • SHA256

    0c082bbcf7f3189477db4f2ffac1e89ecb154ccd03774fa77c6eecfd0c927bd9

  • SHA512

    b9e32671317453649b5de5fbd64337c06ba4469ca7e053ec4ff3b305417bd9fe170af44ccf642e99c0ca2f0c3c9938c9a90e41f613d6cd8abc86ed6409d97a7b

  • SSDEEP

    768:H9cpVPp0msNbXuqmSjHvvS2+1ivSzhGlie5YQwtSiNDCYImTxV/D4NJgGlzDpbuN:HM1KiqmSjHvvS2JccsAU91PxJD4nVJuN

  Score

  10^/10

  miraikytonbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (112173) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies the Watchdog daemon

    Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder

  • Changes its process name

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Reads system network configuration

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  behavioral1