Extracted

• • Target

    122b126bff6a58568f926587d70d62b39aac3ea70d09444a4b833ccb8694a920.elf

  • Size

    54KB

  • MD5

    2145fc7ce8b59b762bc213994757c4ea

  • SHA1

    cdc841dfdef5da8ca20c4302f02adb44b0d8e4f1

  • SHA256

    122b126bff6a58568f926587d70d62b39aac3ea70d09444a4b833ccb8694a920

  • SHA512

    e4ca5dea015a05e599d3236d18eb8d9a354e0bf3ae1454caae1b2d60494d2db0958b2cff2fed7ccc04f5ca6ec3e05d8e536a7a19ba31a94eb0af004087bab21e

  • SSDEEP

    1536:IfleqaSoxf3oaQbFoAtaHejzbS8zHu2ZNgMP2AagXsb:H3f3q3gHebxzH3nPtaH

  Score

  10^/10

  miraiunstablebotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (146442) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1