Extracted

Extracted

Extracted

Extracted

• • Target
    bins.sh
  • Size 325B
  • SHA256 754b41c6595049c9ad2f0eca57ea2606be99b98fe311a51287811029e641fd11
  • MD5 d6979dcee35c1aa4f828ae9679f08182
  • SHA1 85e1ef1684dc87c10e5e3c9cd37554170081b4e2
  • SHA512 28829f682cf23e7fe965b33fb9a12b5eecf67df3c5ba29cba4644f0adae6dc4173218020f78f0f2f10b9188b6cd50257dc9778e282a5851c99772db2233c748d
  • TLSH
    T19FE07D69000235577F4F8E18E53437C035419CA56B10042FD2B96813487CF023319976
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetmiraidefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (23689) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Deletes itself

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1behavioral2behavioral3behavioral4