Extracted

• • Target
    88a8adb23d320d8327e82114c330936112758cb8f222f60dba441aeb4a5ab555
  • Size 73KB
  • SHA256 88a8adb23d320d8327e82114c330936112758cb8f222f60dba441aeb4a5ab555
  • MD5 20c5fdf46a3489798dd50645bddc33d2
  • SHA1 60d0f56903006955ff304f888341e62a82f2d04f
  • SHA512 237bf133a8eea41fbf61740b953382a08df853d60e17ff18d53c3be0db25bd1f377eb77ef775449127debd49ebf3d8e27b1aa131cfdce19ca7b8a165b36cb5fa
  • SSDEEP 1536:PJnL5vY6rAjzyNKdWDiFNzi4tKmkOn8nSTbLRl7kESuy0AKh:t9vYnzsCwinzjK3O8sLLoiIKh
  • TLSH
    T18E7302205605AF42DA355438053E06DEAF471FF82DAE78EB041E932DDA6BC9A17482E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Custom signature

    Detects suspicious XORed keyword - Mozilla/5.0

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1