Extracted

• • Target
    main_arm7.elf
  • Size 245KB
  • SHA256 99feaa0f817b6eb9b010ba3ee21480cf3a34bc258aeee8251d6a6ecea5fc801c
  • MD5 bdf093dea722985bd71a40934c9332b4
  • SHA1 557445aae18ca205042de66583b7b7f8716ea99b
  • SHA512 f38ed09c281eefc1e5d8eea9892f9f1c5a06f61f01a944f5ec687ef1abe3a6c3b79268b70767cda5f7fd4ef21c26cfd38e8b15b7b7628ede697f58d79b496f8b
  • SSDEEP 6144:JCCDujyz0SMvPz7awGZwO204xGLbUlsqcofWAWM/RVAk1v:JCC8D3Pz7awGZwO2zUkQNAP/F
  • TLSH
    T1A7342A41AA408F23C4D727BAF6DF4745333397E8D3E77305DA156BB03A8369A2E26601
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetlzrdcredential_accessdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (348285) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

    persistence

  • Writes file to system bin folder

  • Modifies Bash startup script

    persistence

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1