Extracted

Extracted

Extracted

• • Target

    goahead.sh

  • Size

    2KB

  • MD5

    4407c3e17726938777439c7b1e59127e

  • SHA1

    257407b39db53e6f93df24ffa31fee7df69cfff9

  • SHA256

    0f35c78b4ae8dc35443ca05709319f3a7c89df264fab50dd1c06492208a6e676

  • SHA512

    4c6af409b8b15c28d057e621dee08ac3a77bf56ac76bcea08f038ec56e4dd3101031502e07709362f5a7cd47bd952d4697d50d9e5809644aab2a7ae139e43003

  Score

  10^/10

  miraiunstablebotnetdefense_evasiondiscoveryantivm

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Deletes itself

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Writes file to system bin folder

  behavioral1behavioral2behavioral3behavioral4