Extracted

• • Target

    00d9fe0a6bb4c16c51af172afcd42df3da3ac918af723d4c89465c80b74824e5.elf

  • Size

    68KB

  • MD5

    98520685bcb57b1e7c903aa5b64e2d97

  • SHA1

    6c7e69c20c02e498acd803863207646ef965a1fa

  • SHA256

    00d9fe0a6bb4c16c51af172afcd42df3da3ac918af723d4c89465c80b74824e5

  • SHA512

    396d9badc38762fe160985ea5e7b27e1ec4891eb20db321e28892eba46bc0491bf7b91b732566649fc435a7380b6bfb208ac6e027e0b5cb8249855c8d3cb2a63

  • SSDEEP

    1536:bmuRtG/R7HiIb+wkqER7/kpevPyJTD/Lh1mhIJXXwi1zqP:blw/sIWPt/+eva5bLh1mCJXX/hO

  Score

  10^/10

  miraikytonbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (81808) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies the Watchdog daemon

    Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder

  • Changes its process name

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Reads system network configuration

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  behavioral1