Extracted

• • Target

    55.elf

  • Size

    24KB

  • MD5

    7d7e432e3b2fbd661a18ae730633aeeb

  • SHA1

    586993fce9ca0b6081afde9640aca95b8c035419

  • SHA256

    252dd8418fe8ee024baf5edfc50ee311668d3ea937f5d137f46a894fb5deb2c2

  • SHA512

    1838c53ac751bb1904b4cd771b1244ccfffec936bce1b973225a98ca5c3700860a2f38aedd35776842b45d4e359cd46396c40f60102dcc5e7f9ac1b1eb3bf4dc

  • SSDEEP

    384:MvDKKQOcRpmYLdn6RBOFRFt5rUFW10iSelCo3AnupPFNqnrrd1NEZgO8UXWozPL8:i/QOC0Yhn6ROHWFGrcwNVFCnNBxcoYcv

  Score

  10^/10

  miraisorabotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (87029) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1