Extracted

Extracted

• • Target
    gpon.sh
  • Size 79B
  • SHA256 f343ba54420da60b23802a510c5b5dfd9780873891d447040b63037fedfc5030
  • MD5 60ca337f255f3be9e3b82aed75c34e62
  • SHA1 27d55c50e382a775b196cb34537334cc48d9c8ae
  • SHA512 85da5db709b16003137c14ada5bd8eaead13e4f6f0f7522bcdd834b3d8ffd3d9bcc2f154116efd0a7140232beba280e03701f48abebcf9fe2e58d499209d295b
  • TLSH
    T16DA012D4A900A9327C48C91532280930408241A4983D011480010C0034017007A0DE12
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetlzrddefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4