Extracted

• • Target

    6d7a2a182467276297c8a84a5d2840e7ee335fb985f63cda9e618b229973e1a2.elf

  • Size

    93KB

  • MD5

    307c851a7a0c4b7dd8afd2abd662480c

  • SHA1

    4e2b66521a16a174fcd6581357d289f1ede59cb1

  • SHA256

    6d7a2a182467276297c8a84a5d2840e7ee335fb985f63cda9e618b229973e1a2

  • SHA512

    fd222411e33c1a658efd61c58ea10b634fea81ced709db7f15789ef6733da0c7c211cd218780c1e598e27b7f71525824282348f30d65ed394756060800cda5e2

  • SSDEEP

    1536:2UoxPa6IgF/tlrHa81oSxmJn9u6eucjFb3F9Ubij1DYxl3xQHrHhd+NP:RyP1IgF/D681xxco6RcjFb3F6b49YnCs

  Score

  10^/10

  miraibotnetdiscoverypersistencerootkit

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (23046) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Loads a kernel module

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  behavioral1