Extracted

• • Target
    boatnet.arm7
  • Size 74KB
  • SHA256 cc7bcbeed4c561774c6f2a8f38fcdbe465ac8a6c3670001d8286dd290ed0ece0
  • MD5 f130f95e468c8cd33d934e6b21d7c596
  • SHA1 a99654181fbd76440da25d050097f49068f5e664
  • SHA512 fb38534caf470273154cd072897d1a7e3d68927110f5c3a7226474a1eea26e73b8481b43d41d516dca89c8ffe1c20513df5f20bd2d3f1157332485a8240572ba
  • SSDEEP 1536:I1uKGWWrG6ZdVE9zU5xY5l93tYkfUXFoWKILAP16Xjx5TGSc5sfiL:I1RGBRHCexYzvfUVXJL26TxZGSEsa
  • TLSH
    T15373127B016A1696D320793590660AA42CCA1EBEE3DF7137241087CB4F8EE966DBC2D1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetlzrddefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Deletes Audit logs

    Deletes logs related to the Linux Audit framework.

    defense_evasion

  • Deletes journal logs

    Deletes systemd journal logs. Likely to evade detection.

    defense_evasion

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Write file to user bin folder

    persistence

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1