Extracted

Extracted

Extracted

• • Target
    _6f1646d1e569aaead8d59c51bd2a30fb18940674ceba44ae010e8bf334e9a995.sh
  • Size 2KB
  • SHA256 6f1646d1e569aaead8d59c51bd2a30fb18940674ceba44ae010e8bf334e9a995
  • MD5 098a28addecef07235c2325b7e43ab7b
  • SHA1 4c23263e093331c6428c2ee48bd11461ab3da263
  • SHA512 1ebd0d08f4a190c92ad79400c7363470fa128df1bbf770ab7015716215e18f42f532a4ac71207293f2f5b76c97e639e473b8e203f4c2df92b938f13c80690975
  • TLSH
    T19B4195E415E0B0B574F9FC052659597270E7A0A9BC892E9CBDB43434C9ECA88F0372CE
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetkurcdefense_evasiondiscoverymiraiantivm

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (119351) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1behavioral2behavioral3behavioral4