Extracted

Extracted

• • Target
    chunk.sh
  • Size 6KB
  • SHA256 e530240909c45dca82580ba246a050234b77ff9a930149b98de830325875d84c
  • MD5 ca9abce83c52029de4f9fb29efe167ff
  • SHA1 5a48cd2393264ba4d7e2e9afca692f380741bb18
  • SHA512 68fa5fdf782f601fa0b81e2d5bd8cbf8054d54ef3455dc575150821a5f80f00390fe6518e67be85b383d210707ed74bdde6bfac1e4d6166e917bef5bce220c78
  • SSDEEP 96:GZTJCIwl7PRei19pmxLImzpWCDgQ19JZNxh9WqYX+Bxt8LejU4LJvE:G6TlZnqca9xX9WqHtrj9+
  • TLSH
    T18BD193D2F931C530709E187A9B99B260BEC7542F0A107C14788F7D786F2C66CA2BCA75
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetlzrddefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4