Extracted

• • Target
    ecco.x86.elf
  • Size 210KB
  • SHA256 adc9e93d5f38ae028ea783883fd0caaf8eb29ae582d5a04d115bf1048229997b
  • MD5 71344f7c21d4a74f4b93db3ddc3c7ebb
  • SHA1 e46152a909a9db24a88241624d5256abdc9203dd
  • SHA512 47b4687f7f024279e5dcd484e4a5682dda1d9a197363e34f83350eeb46ce085f2d4be40a11227f8351de3db920c52d68e3ca11c4ee9233c150eb49a834bde4cd
  • SSDEEP 6144:tb7Ns7i2EYN4z8vvUdaNJaV7mZ3ADJe4EFq:tNs7i2EmBvvUdaNEVw41
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  botnetlzrddefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (49274) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Writes file to system bin folder

  behavioral1