Extracted

• • Target
    33450bf6e248cb1b5bf513ba442c50a211db7191babf4b9f05d25af41aab55b0
  • Size 3KB
  • SHA256 33450bf6e248cb1b5bf513ba442c50a211db7191babf4b9f05d25af41aab55b0
  • MD5 102252f0f77a6e9e63a763a18cf37237
  • SHA1 37a68f81fb836e0b215c98f9418fa2a9f9d74382
  • SHA512 b7bc12f3b39f04a42c688d6ed0c05e99e2b7fe5d66d9d53c3be7113ad37e6bc6e6c2e255f2a3c6fdd85d476c7e67a90d5322ce86d78788621909470474cb83a7
  • TLSH
    T10361D0F1B8315833F04D8435AA99B2D5768208FF052A2D3530CEE8947B3EF66F0B9160
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetcredential_accessdefense_evasiondiscoverymiraiantivm

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Detects suspicious XORed keyword - Mozilla/5.0

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1behavioral2behavioral3behavioral4