Extracted

• • Target

    Yboats.x86.elf

  • Size

    42KB

  • MD5

    c0daeb8d95788466f9fd2d1cbaacb69f

  • SHA1

    a1fa77fed8bf0d89bc4c2ac32c033965ac756586

  • SHA256

    689d088228788197f16282aaa19d63d0acfe01bdddd3a331c50c93a340de94ab

  • SHA512

    0a1902b43ac7985c1612ceaddb37b9087df3ec4c5f25e13d28f61b44401804e254b39906cd1caf0460d1f9692965bb0db8457f4891d4ea424615f39c970b03a9

  • SSDEEP

    768:nryy1i4WU+3HDW8THmFlhQXppUtFQywnD0jOj3QS9M0l8nbcuyD7UVyqA:nZ10lqsHmfhz72wwgSK9nouy8sqA

  Score

  10^/10

  miraiunstablebotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (1635594) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Writes file to system bin folder

  behavioral1