General
-
Target
26031f3197346dc7ae2fb61f054a748fe7c5307a66374f1a0ec853e8cb12dc59.elf
-
Size
117KB
-
Sample
240629-bgk6ssxbph
-
MD5
224d33e3fbb634c34b845d62c954aa77
-
SHA1
7f588ecdf2a17ce3fd2ced733b8e0560dfca39ef
-
SHA256
26031f3197346dc7ae2fb61f054a748fe7c5307a66374f1a0ec853e8cb12dc59
-
SHA512
37855e72595a3626d706196dc8663242b092eb3cbc071c43efe5937024e5d43ec918350c44c5956e7df622123ce7eaff10973377d50b9afd76ed96e3c261e941
-
SSDEEP
1536:ShbHSxqUiSF79N9M45lB4KTD6NmQYMv1AROKbDrrOWsElY:ShHU1F79N247B4Kltq6ROJ9
Behavioral task
behavioral1
Sample
26031f3197346dc7ae2fb61f054a748fe7c5307a66374f1a0ec853e8cb12dc59.elf
Resource
debian9-mipsel-20240226-en
Malware Config
Extracted
mirai
MIRAI
Targets
-
-
Target
26031f3197346dc7ae2fb61f054a748fe7c5307a66374f1a0ec853e8cb12dc59.elf
-
Size
117KB
-
MD5
224d33e3fbb634c34b845d62c954aa77
-
SHA1
7f588ecdf2a17ce3fd2ced733b8e0560dfca39ef
-
SHA256
26031f3197346dc7ae2fb61f054a748fe7c5307a66374f1a0ec853e8cb12dc59
-
SHA512
37855e72595a3626d706196dc8663242b092eb3cbc071c43efe5937024e5d43ec918350c44c5956e7df622123ce7eaff10973377d50b9afd76ed96e3c261e941
-
SSDEEP
1536:ShbHSxqUiSF79N9M45lB4KTD6NmQYMv1AROKbDrrOWsElY:ShHU1F79N247B4Kltq6ROJ9
Score9/10-
Contacts a large (7680) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Deletes itself
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-