Extracted

• • Target

    SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf

  • Size

    52KB

  • MD5

    dd979274e98e98c09cec002bbb9463b0

  • SHA1

    4be98164f9324eb25fc688964c19c5c004e60e6c

  • SHA256

    6fd2b5684b508d9cb2c316daad9964381fdb3e3e73ebfe26f0c977385980452b

  • SHA512

    646c2f2e27b428cad0b6a802493a5fc6f3a67dd6ef886e3f81b7bd7d8ad4bd0ed085f23d0617012b3ca34b06847110e8e1debf2be91474b3f529887942163315

  • SSDEEP

    1536:f/fQx7LSrHzswsw5bj9uRDRLWdR5tgZ6c9ot4:P27Oi+MRlLsrtgZ6Oc4

  Score

  10^/10

  mirailzrdbotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20505) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  behavioral1