Extracted

• • Target

    3048a16fd99268166e0442580150ef7c.elf

  • Size

    52KB

  • MD5

    3048a16fd99268166e0442580150ef7c

  • SHA1

    a5a83160266ea057a62543eed4870921aae11b71

  • SHA256

    f3a796c6bbf158eca594122d6416191a11d00584f26902ad0a7f09e886f39521

  • SHA512

    56e59179250a34005b575aa906a41f17f987a13da094d68027fd1741d52b4d8623e5996df39c250acfa0f8bc36525b67ba9614ff5ad9f012b74dbcaa67a091bc

  • SSDEEP

    768:yMte5B4PACtw/YcmRIe18D9q63TxZQbSORe7Su2QJnKE79TLrvw49q3UELbOs8qe:yM84ISRX63dZQbS5rzZYhLIVmWjD

  Score

  10^/10

  mirailzrdbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (18839) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1