Extracted

• • Target

    SecuriteInfo.com.Heur.20230531133228987075586.elf

  • Size

    35KB

  • MD5

    7a9087623c239af857f69cf79fe8b3a7

  • SHA1

    72a74212fb7697bf350ee8923a7dfcab467e7dae

  • SHA256

    a84de46a574ff256be2b974a1243536c34d183198973a89ae9faa6a7fb0de768

  • SHA512

    ea564839fb452ddf0df9c0af31ac5c849252d5fabbc4389257ccfb59bd26b987df7a00e884e6a79ed5bc8085d1e880f430a7f3ca42996dfbc43fdd2e0950eb3c

  • SSDEEP

    768:mE1T2TphOV0R3IE/XZ3nfjysjkry2/rjJ1xmXWMW:mMn097B3fF2TjJ1xm+

  Score

  10^/10

  miraiunstablebotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (160072) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder

  behavioral1