Extracted

• • Target
    1c711a57a19ce85cdc2a024c322508aa77a30316e4b1f33ff61c4b771574e176.elf
  • Size 28KB
  • SHA256 1c711a57a19ce85cdc2a024c322508aa77a30316e4b1f33ff61c4b771574e176
  • MD5 c3598d39c911f5f3920e27c8ebc7e833
  • SHA1 9486684ce55127317c378795af4c0187f403dccf
  • SHA512 4592677bde8a03202549e1082e63b4b797c330e0abbb95e2e76368f91583bce0ebd949d5fa9c16b7f08cf53789ae6dbc33fc04c6a784607450fa035949b8d8ec
  • SSDEEP 768:DvfzqZJ1PWF1u3Nq2bvkZNX9rz87fCK2mHs3UozrS:7bqt1rKzGfCnm6zrS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  miraimiraibotnetdiscoveryevasion

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (53712) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Deletes Audit logs

    Deletes logs related to the Linux Audit framework.

    evasion

  • Deletes itself

  • Deletes system logs

    Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    evasion

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Deletes log files

    Deletes log files on the system.

  behavioral1