Extracted

Extracted

Extracted

• • Target
    sensi.sh
  • Size 1KB
  • SHA256 b25f2efe97508480d4cdd9aadd98ffe795494bc640b2897e0e901cf30d63f84b
  • MD5 4d1ebb7dc9996a10052d34e59460dfb2
  • SHA1 55e0756713edfb7faafab8eb58264428dba0c27a
  • SHA512 15ac627e1c248b65dbe48783dd23a78a440461a5ee83e3f1056458c8a8cd449a063b6d0d1da42f9c510e0cd60ce8f1485fb1ec97da4bc7554b7b1b69607f3b06
  • TLSH
    T18E3181C91085B17B6DBBEA2375F589053280989BB4D9BE1CDCE8B8E584CCE14F4C0746
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetlzrddefense_evasiondiscoverymiraiupxantivm

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (162419) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4