Extracted

Extracted

Extracted

• • Target

    jewn.sh

  • Size

    1KB

  • MD5

    49377a7c5220a2e428c4ff6898fcd50c

  • SHA1

    0d2843613a97cc150c539474b2db2ff741260997

  • SHA256

    336fc216d10d88ac069d22db53159229050040ff570e610ddcca11040e666a4c

  • SHA512

    51189375074dc361c0b855ae89774e7888a0a3360bd8291f2d99ba2bc8de4cdf8a2307044d8aee9d9459973f2e29b5d866b7b004e7df754688324a207d77b342

  Score

  10^/10

  miraikurcbotnetdefense_evasiondiscoveryantivm

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (112638) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1behavioral2behavioral3behavioral4