Extracted

Extracted

• • Target
    micro.sh
  • Size 5KB
  • SHA256 d0d585f6fb79740adf8ce8165db6c5d391e4a3ade4fa5d8e54ae439c6b43eb62
  • MD5 e4105c72f73ccae684cceee45d94019c
  • SHA1 494cc2027879b296a1091a77f213d19912768796
  • SHA512 9aaa29df3380a18777191d4908cf460aa90f102bbf29af111c9c58f88bf8c8a824123abd9df2c6c9299f2c2238cd2d1e9bac778441dca27433960f92a0e84981
  • SSDEEP 96:GZTJCIwl7PRei19pmxLImzpWCDgQ19JZNxh9WqYEt8UUkLJvE:G6TlZnqca9xX9WqFtR7+
  • TLSH
    T1FDC192D2F931C530709D187A9BC9B260BEC7552F0A147C14B48F7E386F2866CA1BC675
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetlzrddefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4