Extracted

• • Target
    phantom.x86
  • Size 24KB
  • SHA256 287962211de7bcadb39f7576732438b43ee6aab420ec23c29a9d12a8151a547f
  • MD5 e59ed9392c2bb285fff6377d4b4efcb8
  • SHA1 d3fa4b2d9bcc45c34eac5bc4d8b2f0355648d0e3
  • SHA512 808734e98051f5ae687599866b02593e33504f0b554f571ec5cc62a2a98c0db2753c859bc0479b5f49a61d74d3c19d6fbc17c98adb93099aba3da91b4f4e3e59
  • SSDEEP 384:Mi7moy6+jH+dv9tKcgRT2QpID7sd3ZgNzJbEq06bfp0rQoLq6u9dJeD79tUmv09c:1ioc+dv9FiHy7sd3Z6Jbd0ktoLqt9PM
  • TLSH
    T176B2F17C9D4F9127E033C3BB67174E2B753465E1938EA23332CE80B856C91932F65998
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (101408) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1