Extracted

Extracted

Extracted

Extracted

• • Target

    goahead.sh

  • Size

    2KB

  • MD5

    881ce575c9446782fdfc225811aa70f1

  • SHA1

    280424cf6aeabfc79aacdeede9e571d7a8e836b7

  • SHA256

    689eb376bb67e06cbccb2cee8eb5b38c57b40e3358ca78c57dab304c88ed0efa

  • SHA512

    d233ffbfa9ce6c37ff6e9a28219e4449dc09ac5246fe17df756f8fa6afb01e083c4ad7bb5c5cd7e8190af74ca7120854493e8260f2ac80d2af8a346e841e5491

  Score

  10^/10

  miraisorabotnetdefense_evasiondiscoveryupxantivm

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (35321) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4