Extracted

Extracted

• • Target
    phantom.sh
  • Size 6KB
  • SHA256 183fb8e38eeb1160f392f6d3c473752bc5b183a5c744f23a31dcc5ae2fda87f5
  • MD5 eef6cc06f43712760c321159f2def25e
  • SHA1 98f9f51266c386e966ed829e6e952b9088f526b2
  • SHA512 8a6a0a5d3c7f5fe0fb36324f9f85798b4d11c0d7c6bec434dc52868d2387abf75014f3a04291f22786105e4627630b4df3841c3e1143b0ca5d94e6a4bed2dcac
  • SSDEEP 96:i/XYz0zy8BJF1KZMpJGNsnAAxzJzO9CLCshhD4s1fd96VYLk89Q:x
  • TLSH
    T1BAE1C286F15198763DE39D6B23A5C40072967832EDD26E0570D838FA8E8DFD278617B3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymiraiantivm

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (471840) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1behavioral2behavioral3behavioral4