Extracted

• • Target
    3ade73c820f24864b0e9fa86d49d2cb0c22d5d520c1b0397651d705fbae9887f.elf
  • Size 85KB
  • SHA256 3ade73c820f24864b0e9fa86d49d2cb0c22d5d520c1b0397651d705fbae9887f
  • MD5 d8b72c71a27a9864da9c3dac8e704605
  • SHA1 9359e6f027cbae61fb10a34f5ea867fbd14ba0eb
  • SHA512 983736b124d271cb9487603ec3f9315ccd43267949295552d90e64322aedbbbcf41fd5f67163b81a78954a2f0d7f437077d1ac86009c776f2951ca421cb6e383
  • SSDEEP 1536:X18tu0qO4TMOYC1k0uMgMUHliHqCE314JlsqHIfjBYOgUIzrr:XGtO3TMOnkRhJMHqD14Jlsg4jBYOur
  • TLSH
    T15983495375C080FCC98AC134979FB236D863F47E1239F24A27D4EE167D9DE502E6AA81
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  antivmbotnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Deletes Audit logs

    Deletes logs related to the Linux Audit framework.

    defense_evasion

  • Deletes journal logs

    Deletes systemd journal logs. Likely to evade detection.

    defense_evasion

  • Deletes system logs

    Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    defense_evasion

  • Checks SCSI settings

    Checks list of SCSI devices which may be used to detect VMware or VirtualBox.

    antivm

  • Checks hardware identifiers (DMI)

    Checks DMI information which indicate if the system is a virtual machine.

    antivm

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Deletes log files

    Deletes log files on the system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Writes file to system bin folder

  behavioral1