Extracted

• • Target

    h0r0zx00x.arm7.elf

  • Size

    54KB

  • MD5

    486d2e2c7c3293a97e00e3dc06d6a6fc

  • SHA1

    b5e70d23649b1bb96c43bea3df9956f3c5336746

  • SHA256

    e80deb534c05c67ec13509d53b252e30a29cc2c433d893233cf724caa682e9b4

  • SHA512

    218181a1f5cba39f3db3f0f88f5cd005fe1ccfeede977aab4cd3df154b097051e9f121764775635e1d243eaf291ffbed3a667a1b196d2e54fd2dd9eb36acf1b3

  • SSDEEP

    768:0yXFyXFhmVf5fUJnFHTI2T0Ki+SUJbJOAyS0gwzfHq3UIynPsygjuKNAr0ze0pEa:RuFhKtOZI2ThJPtwzfoyPNqLNI0pE88C

  Score

  10^/10

  miraiunstablebotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (151958) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Writes file to system bin folder

  behavioral1