Extracted

Extracted

Extracted

• • Target
    79350f516b6217db57b5caacfd7e99377956f540fa28d714b93097ac0cf422f4
  • Size 3KB
  • SHA256 79350f516b6217db57b5caacfd7e99377956f540fa28d714b93097ac0cf422f4
  • MD5 b5055695c5e2facbee39911ffa7dc842
  • SHA1 aae163303c70d3eaccc87cbdc5e991b5bbcff62a
  • SHA512 227d6ea7b0384278cf0fd7b879cd31300eb20e651a0cecc6c20c4153f77dd2c6994c66f740c31dd470d6bc512eb0240c827bb0c6ac02934d4b01bf593e171abe
  • TLSH
    T1B271938A115F09B49DE6CFA3B2AF431C2D8190BDE4D6CE4257ED2AA80C4FC58792C573
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoverymiraiupxantivm

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Custom signature

    Detects suspicious XORed keyword - Mozilla/5.0

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4