Extracted

• • Target

    mpsl.elf

  • Size

    35KB

  • MD5

    4808a808fec25b07e9e28b0238e0ba4a

  • SHA1

    d3c97161ae9ed8f0d926439a3ae42d48f962d726

  • SHA256

    a6c1a94828b01c0aacd96159919d36031dc10713a00da54945dca3676f1036be

  • SHA512

    61e9613881baa8667f0c7ea7858944b629af24c021ba9b15a22a1b1290cb57b71d59ee4aa14bfea1263989e57f8d4668cfad368350c686b4d1783c973c33eab6

  • SSDEEP

    768:PailI++SHdh9D+NWkWej0/RJkCWk9uqmVwv5sfDWy:Jl+SH9D+NW3e0wk9uqmVwhsX

  Score

  10^/10

  miraimiraibotnetevasion

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Changes its process name

  • Deletes Audit logs

    Deletes logs related to the Linux Audit framework.

    evasion

  • Deletes itself

  • Deletes system logs

    Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    evasion

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Deletes log files

    Deletes log files on the system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1