Extracted

• • Target
    b3astmode.arm7.elf
  • Size 45KB
  • SHA256 2ba4ad3d65f6be64e0855c61529b121f62f1899cdb7cbca78f5bb0697c8071b6
  • MD5 c625720ee8b4ab609ecbd353c29bd8f0
  • SHA1 7020b34daa276ca5c93637a9833dc80add2553e4
  • SHA512 c36e2fb6015b7595daa5ce3fd25eaca6407a6abd23deee09a9f092731242dce4c2bfdadfac079b5b7585932192ebec03c369d769150fe004d29988690b6e3e90
  • SSDEEP 768:ctf3ZnAnCh5cx6kq4SDNmfHwerUSFAsYs4eaG9q3UELiLnI2t7+uFPS+b:ch3ZAnCko42m/werUUHHarLiU2ti6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  botnetunstdefense_evasiondiscoverymirai

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (69935) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1