Extracted

• • Target

    mips.elf

  • Size

    34KB

  • MD5

    5f983a94507abae4f188054b7b2e55ec

  • SHA1

    801b0f681971ef167dfbc6d5d5d32fc07228241d

  • SHA256

    10686a12b7241a0836db6501a130ab67c7b38dbd583ccd39c9e655096695932e

  • SHA512

    5f4972d4602fff05c0c1e5a525140193af3e24069ff5b505cc9dc503fdddbe194760984e91c80271002f97bf0b2003d248bb081ea39beb0ea2d0aac1ca307f58

  • SSDEEP

    768:90EQrTzqfaGaoWSfwu8tobYY5iSUnfpPEz+Qulu7BJgGlzDpbuR1JwH:90HrTzqhaoWSou8tDYYZqS6VJu+

  Score

  10^/10

  miraimiraibotnetdiscoveryevasion

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (46061) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Deletes Audit logs

    Deletes logs related to the Linux Audit framework.

    evasion

  • Deletes itself

  • Deletes system logs

    Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    evasion

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Deletes log files

    Deletes log files on the system.

  behavioral1