Extracted

• • Target

    d8dacd3921a016ab597a8ffcf0aaa9496b3aef0c6b8c089511a37ffc34d1518c.elf

  • Size

    31KB

  • MD5

    7557f4107ed3ed4e291577fdbf82dea5

  • SHA1

    cdd7a2d038a0eec2549ae1436ed0773d80a8f4db

  • SHA256

    d8dacd3921a016ab597a8ffcf0aaa9496b3aef0c6b8c089511a37ffc34d1518c

  • SHA512

    f09993e9c73c93187e2fc49ad4c2acc53445f2ffee0a6a6e4178272bc287e6764dbfb09b7d835d0ced91a5d65185c0ed861c2666f7b99899f27e0f3706087c3f

  • SSDEEP

    768:VO1s9gKZjYfvymcPuf3NMGq9oVNDEGCFnuwdl8FJkaVJgGlzDpbuR1JC:Ss5mraoLC/dl8FJxVJuc

  Score

  10^/10

  miraimiraibotnetdiscoveryevasion

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (70109) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Deletes Audit logs

    Deletes logs related to the Linux Audit framework.

    evasion

  • Deletes itself

  • Deletes system logs

    Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    evasion

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Deletes log files

    Deletes log files on the system.

  behavioral1