Extracted

Extracted

Extracted

• • Target

    115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh

  • Size

    2KB

  • MD5

    a0e87c525c403e7c7d8eeff06a6a8b5e

  • SHA1

    5331699066a78b7e546b6e77a095df7ff24c9f54

  • SHA256

    115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104

  • SHA512

    6b270443c2f5ce99a9e4a5cad6480d0e7b6bb22b1704e7b1c1e2a99815e548ea463f025679903d7ef83d360003a5ba238d2168a0445943219963a9f9765b054e

  Score

  10^/10

  miraibotnetbotnetdefense_evasiondiscoveryupxantivm

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (94604) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4