Extracted

• • Target
    main_x86_64.elf
  • Size 191KB
  • SHA256 30d49b74a5c28e08efb2b331595075d0e1a0e4b7b6bbd9fac308841e542737cc
  • MD5 99e6eda3af958de03f575680c8e4a320
  • SHA1 2578a9e24c10202260408497942ce679ae1c88dc
  • SHA512 4061680f95e23e78757af10c0ce6d9c497fe4e9df936fe60f4d9f072e8b0fd6c141ca3014549d40eab5378ac800dea0115cafa4077f390a1fa7b7319cfd21ceb
  • SSDEEP 3072:wNhiKC7pQ3s3kS9XfivQWkPlU/c9y/lqV61afTNL4K09FvSu2pegp1468m43PBs6:wNhiKC7pQ83kS9XfivQv96k4L3vdJ4Yh
  • TLSH
    T159143A06B1C05CFEC8C5C3788BDFB536A83AF08D5225B65B6BC5BB212D4DD607A6D680
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetlzrdcredential_accessdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (649689) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

    persistence

  • Writes file to system bin folder

  • Modifies Bash startup script

    persistence

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1