Extracted

• • Target

    xd.arm5.elf

  • Size

    34KB

  • MD5

    b8d08e79128f53c1fe72d2a752bc6b7a

  • SHA1

    2ff1475b4ae9dcc6d9688f95a407b1c8ca12efc3

  • SHA256

    4196c207e9e8847a0195843cb05870399319a3f1c6ce44c8e2b33517857de621

  • SHA512

    ff336afd9882c9c45f92228cbb94c098f09009f0cad0ec5a61f6ea584098b9e3f0ea45bdb5e272bc2bba4caf4468e931f8010952fb036f934ec302ecaf23c87f

  • SSDEEP

    768:IcO4mdRZuzUmWpZgYbQUzYcLFdq0PrMVfBvtIXs3Uozz:LO4mdR0zUlgYcaRSikBv2Kzz

  Score

  10^/10

  mirailzrdbotnetcredential_accessdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (20509) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1