Extracted

• • Target

    arm7.elf

  • Size

    69KB

  • MD5

    dfd763aa10da61d0118a56047872e6ba

  • SHA1

    550d0c4bc572e643db24202382aca5c47bb9daad

  • SHA256

    d2a6e2d97bf8488de2788515a852c79f677a6d2734a0f45ce29f44076fe1df39

  • SHA512

    70649ff09e5072d48132dec80e0146d9b727b181bbfc6866c11ea50a06478a3b8f33d8aced6f68443eee4c8fbd371ea51ed7383a45788ec01a373d8d567f023e

  • SSDEEP

    1536:LhZTRDjZhI3Cr5rfJ7mwHpmTlHhp8tq6qAK:Lt5m3Cr5fJ74383K

  Score

  10^/10

  miraiunstablebotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (370913) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Writes file to system bin folder

  behavioral1