Extracted

• • Target

    mirai.mpsl.elf

  • Size

    118KB

  • MD5

    3022d8d617de493e53d40cf02ff12aac

  • SHA1

    024784163955d70de27ade20b60a648dd4be9264

  • SHA256

    c4ca35db2a19f880b40867e814250a55d27b1621c39160ffc436e6653c06f976

  • SHA512

    73f4a9ffc0b28cc1c4aedfec3d4c9b09d6171a848b32c6eabedf60f953ff6acedb6d9dcf3517ec5d5864755eeaaa6d7729b2559ea776b025c2b317d9db0db51c

  • SSDEEP

    1536:zxPRAmySO4TJNXIav45fSvJyRIDuGnMa9toHbDrOjP8El:zx8SfTJNXIw4VSvJ/Mwom

  Score

  9^/10

  discovery

  • Contacts a large (23994) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1