Extracted

• • Target

    xd.x86.elf

  • Size

    29KB

  • MD5

    cb02e84a85813c662f7191cc1d19685f

  • SHA1

    59ad600226c432b1b8c3a077be7a6c280c2da1a1

  • SHA256

    3aff058d7b58eb91ccde83818aae5dd597aae06d96ab89c080c0a3d88f877f31

  • SHA512

    ea9bea2cb21045791f611089d04714ef109dfc77d462763811bd4ce0dfeae93e7b6bd26637ccfc32e840504de17bf7da45ec29f0639f724de77ea985226e2f82

  • SSDEEP

    768:W0qH8ZHtmpb0eJ7LI8GqRZLSbS+gl5xV30HMVj/WHVMe1NxUkOGqC:WvH8HtmtvJ7ScP1mAiHeIUkN

  Score

  10^/10

  mirailzrdbotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (20453) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1