Extracted

• • Target
    main_arm7.elf
  • Size 247KB
  • SHA256 e4b33a676e966bec0c11f51328eefcef25a900a42c8bea219e921b56a550ff60
  • MD5 43120dc3c0edfd2c69c2d417968b1e94
  • SHA1 023e930a893cb2d028edc72c8dd101495efd0647
  • SHA512 fbe7b66cce923985ae72763b0957b015a0b5c29a063b80f365cf6c3c9aeb4532e4ea832439c57bf0ec347e70b0928dccdce2379e5a99c2ad2864c006e7bb29b7
  • SSDEEP 6144:cKGK49WLEy8TM+3Faerc+FUaeSIC2rUls6jaMjSxsgKDM/Rrtmnqr:/t4oz+3Faerc+FUIxPXXWsgKY/53
  • TLSH
    T10C442B41AA404F23C4D727BAF69F4345333397E4D7E77305DA25ABB03A8779A2E26601
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetlzrdcredential_accessdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (442744) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

    persistence

  • Writes file to system bin folder

  • Modifies Bash startup script

    persistence

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1