Extracted

Extracted

• • Target
    chunk.sh
  • Size 6KB
  • SHA256 1a0b68aaa68362b41b3f24346d51f187e8a61fea0bbb978c672f2548b08b4afb
  • MD5 73a92d19903747de6ee29e792b37b26b
  • SHA1 1661a82bf6b39da25427f855b31eb2f2eb3b5d69
  • SHA512 269ece7d4301f27e99a6ab3ac3e1510c7c83e754ffe3c99413275668742b9c118313eaf808f845e7a0937885f5fe38eea00d5c44137abea834a492bd8271dac1
  • SSDEEP 96:FuDx7R/wlHPRei19pmxLImzpWCDgQ19JZNxh9WqYX+Bxt8LejU4LJvE:YYNZnqca9xX9WqHtrj9+
  • TLSH
    T169D194D2F931C530749D187A9B89B260BEC7542F0A147C14748F7D786F2C66CA2BCA76
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetlzrdcommand_and_controldefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4