Extracted

• • Target

    mirai.mpsl.elf

  • Size

    78KB

  • MD5

    ea2acd44174bf878b3ea7340599e5ec7

  • SHA1

    d01f2ae0b6332b4e1de6c70fd343184569e42cab

  • SHA256

    3e57c18d02b60bcabf7c533668c9515396d86874464d609f230d28635fa7fcba

  • SHA512

    da919e091b72e6fe17fb269029ef4707926446f1287eb9f21c323721c5708cfd35fd1b66c3d0c7d6ac809e47d0a55fd13335b2bda1367250baf3d216a90dadcc

  • SSDEEP

    1536:8Vu0vLwRoSXtGRm1FoR62xk3MDuPS8pyIzBTa:8c0vLwR5ttoR62xMyIa

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (19905) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1