Extracted

• • Target

    SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf

  • Size

    29KB

  • MD5

    0e9baddd505edcaf077b6935323b608f

  • SHA1

    8cedefd89863bf40ea986e8a0ed6bdaf5b3cd6e5

  • SHA256

    f5a9ea37f7c2b08313ca8da83d0e0685d5539d3ae23a2276bcd22513a97b5b39

  • SHA512

    22cf27fe8af73422d53bdf90737384f1add00f64952a1b63eda85f0d4b65c9876351c82fb3ff2ee95f489a58539145a68352c3e65fb3c01584de0a6f18b7241f

  • SSDEEP

    768:WiD2DsL6HKyWt2KCLcK1A5RVBTKgGws3UozK:524L69W9K1OHYzK

  Score

  10^/10

  mirailzrdbotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20358) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1