Extracted

• • Target
    akido.x86.elf
  • Size 29KB
  • SHA256 d7384a27ced3edfb96a6480ce4741212a0f5de944fa7ec134623305ff7f5be49
  • MD5 8ee1a58dcac05f549b98c5a063304fdc
  • SHA1 05fc67804765ff155e1c4da3b582410ff6488dea
  • SHA512 3e3ac6c1aedc3c9d38fb4918b05c2a5626dce4a761810353531be86bd542a933455b95d18743133d930024e26a8fbafc5b5c0899573f7f81d381a38d2cdb062b
  • SSDEEP 768:EcmROmIIAiO87AapE5gV+FY3IbpVXupD9tJmur:1vIAiO8sapigEmmXuprP
  • TLSH
    T13FD2E179BE4913ADF8926735A86BC87BAD92DC62577F81CB03C489122138415DB34C89
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetlzrddefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20310) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1