Extracted

• • Target
    99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec.elf
  • Size 35KB
  • SHA256 99018dfa33e27f481bfa457c794e9908d6af1111eb74618b87c45f867158c0ec
  • MD5 3c25f39e80f7cc6bbe607ba99e3dc248
  • SHA1 45d40c50b801f96d2d14b9f453fa0247e6a6d842
  • SHA512 b2bc638d2d8f76c1fba2a781b922ebb04ba7a59f9675aec33fab9b62dbf20ae37067a5435a4164319d14ab374f3e83f4d79ff1ce26084dc80e65db5f90e3984a
  • SSDEEP 768:oPRpsskbodln+2j9nGblZenQDuQVTNUhC4l/RLwf+ch/49q3UELr:w+bf2j9eEnyuQjU9hRLwmc5hLr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  mirailzrdbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20300) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1