Extracted

Extracted

Extracted

• • Target

    aws.sh

  • Size

    2KB

  • MD5

    536445c4ec7cf56d25298e365dbc8bcd

  • SHA1

    c37bc7a74033a94b3cd0a6d5c53045c156882aae

  • SHA256

    35771aed636c9569a032b350699efe36770c811b09fd9d9fbd77f03f8dd8ad36

  • SHA512

    42d3911a2a0b9ba4dee80dd08f2d8c491e5b77e90cb7185e30a717c028243c5df9f0879ee22dfb4629e62c9d7da9e21a01f86613bdd74f65f9d6c76b1ccbfdd3

  Score

  10^/10

  miraiunstablebotnetdefense_evasiondiscoveryantivm

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Deletes itself

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Writes file to system bin folder

  behavioral1behavioral2behavioral3behavioral4