Extracted

• • Target

    2e3707b84c691b4c68d2826be50ece7ce989a9eed1076cc8a36e45359f63e96d.elf

  • Size

    32KB

  • MD5

    675ff21eade2513ba3b1e820889659d4

  • SHA1

    dcd860925821d705ed6c9f7903266a4488b9bc36

  • SHA256

    2e3707b84c691b4c68d2826be50ece7ce989a9eed1076cc8a36e45359f63e96d

  • SHA512

    34a73cefe1eddb9033870ee0604f2daa4b1aae2b7cb67cc82cc49852d69306f165815c1305da24570851a59276ee5a80d9b336b171b975c9b9b3eb7defa25ab0

  • SSDEEP

    768:L4nfDhOZWJZZOUWQH3XVe75rJgGlzDpUYsUB:8rqazOwH3lAVqYR

  Score

  10^/10

  miraiunstablebotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (137922) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1