Extracted

Extracted

• • Target
    sh.sh
  • Size 1KB
  • SHA256 b93c50bf08ffdd666baef615ab59783d3f0c8d68d6e80bdb6f028f9373bc1b96
  • MD5 c5848645d69c2180bdb59c45e87cf5f1
  • SHA1 e6279666995951839971e13365e3d2d6c602c6a2
  • SHA512 7db9e56ba4db09673225ee77764d9ca17a3a9e725ce286685db683fea0a03c0ea344e42127f6714cc306ca9730ccae1f776c3a782306cab7edb3d3057be64bbe
  • TLSH
    T1274113D916AD42792FEB5D27F2AD9449B18896A724C06E6E5DDC3CB4824CF042449F83
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoverymiraiantivm

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (130649) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Deletes Audit logs

    Deletes logs related to the Linux Audit framework.

    defense_evasion

  • Deletes journal logs

    Deletes systemd journal logs. Likely to evade detection.

    defense_evasion

  • Deletes system logs

    Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    defense_evasion

  • Executes dropped EXE

  • Deletes log files

    Deletes log files on the system.

    defense_evasion
  behavioral1behavioral2behavioral3behavioral4