Extracted

Extracted

Extracted

• • Target

    134dc395ec12b8f0f040be5edec53a6162732ad047b5f9a37132036bbc71bfea.sh

  • Size

    2KB

  • MD5

    bc40d4bb4de4a22bd513d81d70e0eeec

  • SHA1

    996bf695d315b1848bc06b61cd5344572864759a

  • SHA256

    134dc395ec12b8f0f040be5edec53a6162732ad047b5f9a37132036bbc71bfea

  • SHA512

    8dac2fb98c24f274e9212e7c56ee8b89b83e987758b8a98d8cb15d3848ce1f8695712bb93bd5d47cb3dd28d9335410d4f358eb620a9ca1afe4794732bad411b3

  Score

  10^/10

  miraibotnetbotnetdefense_evasiondiscoveryupxantivm

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (94694) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4