Extracted

• • Target

    730859ff16c34d990ddd18509a1a3c22a9b582944fc68e6411f9895b79239895.elf

  • Size

    58KB

  • MD5

    7324dbeb098c782561c906ebab3ee1ea

  • SHA1

    e6f5ea8561a51cd096aeb2e10a98e17199e399f8

  • SHA256

    730859ff16c34d990ddd18509a1a3c22a9b582944fc68e6411f9895b79239895

  • SHA512

    c5f519317a58b39d44af0c137a1f3cc8634a1306602e210f342e560ac68fba3fef05628b1058617e0673e104a1d06da98a74f2ac0817830146a0f955a5474f4d

  • SSDEEP

    1536:gbxVDNur8IDoG2zHn0kRCjsLvPVo1PpLN7GAfR9IM3/csZze/J:mxduDSntRqsry1Pr7GAsO0s0/J

  Score

  10^/10

  miraiunstablebotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (229916) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1