Extracted

• • Target
    0a90a30d17806caca645ec1655f0232f75c66999b0475c87bc7d698d9cd7da6a.elf
  • Size 56KB
  • SHA256 0a90a30d17806caca645ec1655f0232f75c66999b0475c87bc7d698d9cd7da6a
  • MD5 11c90af56316343756efae37c61ae83c
  • SHA1 30dab5242e7799ae2cc5864ebaeb1c6e2a02fdfa
  • SHA512 1d16de5c7e6e8df339568e56cb75b4a5bdaa69371152943fee31db4997042da4db12853ec31b984da49f1cc704bf9024d523a24f985c22f2ef183b96246ec723
  • SSDEEP 1536:DfVPcxTjoptM6P7eEfgd716NYigTkDEc3kMTv:DfVECphTjId5kY7c3Z7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  miraiunstablebotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (215045) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1