Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    all.sh
  • Size 771B
  • SHA256 39fdaaa503065403e9cca7ea29efd9d43f245b8b976cfadd70ddb1d364ddffe3
  • MD5 df4bcc77165dce73df0b2ad004fff710
  • SHA1 a74a2dba577b4d73d81a641eaa2ce6f11a45dffd
  • SHA512 b32636f910df3d8480c691c421cfca70578d0185beb5f36dcfb98e74347546417f04c396bbff53fffde73bc1a338128c75b68c2c61741ce4d312bace97bd3359
  • TLSH
    T15901B9E1217414F63AEEE4DA59731C1C318654753D865CF83C6EB4D6359DC84B0B2899
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetcredential_accessdefense_evasiondiscoverymiraipersistence

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1behavioral2behavioral3behavioral4