Extracted

• • Target
    kaizen.x86_64.elf
  • Size 153KB
  • SHA256 ecb04b1082ec832d4194868ed295515b762934fcaee5acd83d923c089c84acd7
  • MD5 be2b04e162740cb4d53822c57c7a8643
  • SHA1 688adba81c801d393b5711f481dbfb8be1845436
  • SHA512 96dfdd91fc95595f4d470eceba2379a744cad889fea1d6a12f22f38ebfeac97a270389aaca8c7809568356dd9ce5f43c4e7ed1c2890b4953c3ca16a45c2dcf10
  • SSDEEP 3072:kIYJ8cs9sdjxSfoNcyfKQzdgzB6yhHDq4lvmdwmu6YpmDrwIXFZx:5YJZs9sdjxSfoNcyfKQzdgzB9hX7m3r3
  • TLSH
    T1BEF33947778244FEC459D674666F6936DC29BD6E023AB2AB23C0FE157C4DE20473BA08
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetomnidefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (951063) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

    persistence
  behavioral1