Extracted

Extracted

Extracted

• • Target

    4eee97d2f9a4cca13e5c376aa26e1258b9994ecec267b2cbc6e879890a2259f1.sh

  • Size

    2KB

  • MD5

    3f86bcae03caf55177b7f7f6147e7ecf

  • SHA1

    33fd9ca28f8514fd389d298b46b0e1613e8bb8bb

  • SHA256

    4eee97d2f9a4cca13e5c376aa26e1258b9994ecec267b2cbc6e879890a2259f1

  • SHA512

    24f2a3727d123b1ff7a3803e494fad24bacd8bcee0ea2157cec602b56ecb8ffed3aa2b6788fbfbf752818bfd9e250a144e6f3d800279717ab19aae4e98025f11

  Score

  10^/10

  miraiunstablebotnetdefense_evasiondiscoveryantivm

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Deletes itself

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Writes file to system bin folder

  behavioral1behavioral2behavioral3behavioral4