Extracted

• • Target
    px86.elf
  • Size 44KB
  • SHA256 7780fb81a5342b747a9796b6ba6a401c0259faad077cf9ca739ef70e14e75c7c
  • MD5 59e6dd5975c7d59bdad6a7727b43497d
  • SHA1 af995e59c8814dee2eb5482b2ce2142893a2b2fc
  • SHA512 30d71f923c54031c5a8faed47cfd94caf0c55d279bdad34e40097fd8db34e33a0550ef173926447a211f0a38753d5ff891e81b3213bcf073a33113ffc86022c9
  • SSDEEP 768:tpFdfC+9Ox+6lYUg01B1AY4UoLJKJIvEIs/RI3TaYtkjWRZKJdjnbcuyD7UGQRjW:BdK+9U+QXg01N4U+4iEIFTBsWRZiZno5
  • TLSH
    T1EE23F10202E04FC5E1A951B8E1DF7E4F6450B0581D34E8F6EF1E642D8CE3725A96ABE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  antivmbotnetmiraidefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (543742) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Checks hardware identifiers (DMI)

    Checks DMI information which indicate if the system is a virtual machine.

    antivm

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1