Extracted

• • Target
    main_x86.elf
  • Size 142KB
  • SHA256 0d87a0985a608c6e0dd1c43d37eabcb525f23e65630a9bc5dcd46a0c898bf502
  • MD5 c6c5d9ece6137d1fcb8ba253cb1e3c08
  • SHA1 4c011cf13656c217ec3e6b406335d567560d5fe1
  • SHA512 eaf74c563434cda9072f8014191263bf80f8161c16656ba79d8c41decaba83f4530e96e5c2b9df3e112ebe42c411851de7d51969956c4b055612322c53992d4e
  • SSDEEP 3072:/5MNWznwjBYDIstv5gWKyAKgphVXNwMY468m43eCQ4:/5MNWjwlYEYB47V9r/OCx
  • TLSH
    T1DBE37C80F343D6F1DD924372502BAB335632A06A553BDB42DBEE6B31AC45540FA2B39D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetlzrdcredential_accessdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (1353480) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

    persistence

  • Writes file to system bin folder

  • Modifies Bash startup script

    persistence

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1