Extracted

• • Target

    arm7.elf

  • Size

    61KB

  • MD5

    4c729108aed369e34f23591228faae82

  • SHA1

    65faa5ee4b29e9186034b92065fc6747c4227d05

  • SHA256

    74b749787b1ab4cdd9073925ed2ce4af999f1e05fa704274a05923236b8de917

  • SHA512

    68dc4001294e8d8d631f92687d2ed87f7d067167aaeb5fb21019bcc8733df561eda86e2443816742022df9f07ffd7896363e5a8a58be3b970015fee137c52303

  • SSDEEP

    1536:BeIqfnocUDwSSrDez+0qFRio2hAjkWnPX0CyGF:BeIen5UD3owqFJ22RnPkCyGF

  Score

  10^/10

  miraikytonbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (91213) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Writes file to system bin folder

  behavioral1