Extracted

Extracted

• • Target
    lll
  • Size 505B
  • SHA256 09fa8c3ac6f5c330bc782ee21f9a16ff708f5b35329cb92c9e6d2d2d886ed831
  • MD5 2786eccae0710f3d936da000d8190557
  • SHA1 341499b8642b8a4e04215d83cb90f5e117929029
  • SHA512 706a96171504c8d20d79a2230bece9fc4be0cb17f1e21ede20544d5a298ce0c3d64f615ce252a84d9aa398555ac3fb362f40c6528ecf5da979ea9b69980479c3
  • TLSH
    T18DF059B9B5522332A9C84C3F34E790E0724220A619432C10504B38736ADDF14A4BC115
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetlzrdcredential_accessdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (1198020) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Deletes itself

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

    persistence

  • Writes file to system bin folder

  • Modifies Bash startup script

    persistence

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1behavioral2behavioral3behavioral4