Extracted

• • Target
    2690b9cf6cf4fb68cf7d0d7b6a13793d842304767efdb9632313594a63e18f53
  • Size 4KB
  • SHA256 2690b9cf6cf4fb68cf7d0d7b6a13793d842304767efdb9632313594a63e18f53
  • MD5 e7153ddb218f64efa7f8bbb1176a6d4e
  • SHA1 09f4509204b86e43141e4c8384e516ae659a0d77
  • SHA512 21624a23b52ee7968f0a6e8d3f85c66d7f4e552c713fabaa088850206d786650c9a41f0079381de179c2c13673522a71f583ac8e84ee051eb848e6793f03fb95
  • SSDEEP 48:dxh+FxFSQxlmLxfuc9uuheQJx1uaxhMPxBaRxZHyavHyqBMeaSxRI48xNKkxTIAx:pyVSuc9uuhBxXYO2q67JPPESPX/V
  • TLSH
    T1C8A1CFF5B420E134FC5DAA3634B9A5C06186ACFB4D923D2474DA7CE2144EF2A708D6B3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetcredential_accessdefense_evasiondiscoverymiraiantivm

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Detects suspicious XORed keyword - Mozilla/5.0

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1behavioral2behavioral3behavioral4