Extracted

Extracted

• • Target
    cache.sh
  • Size 4KB
  • SHA256 abdc8e3e53c5c9b33da7d0bc1c25ca005802e39c86b88fcf18f4524d76e54c72
  • MD5 e7305ad2ae2e8337c8481a97996bfb57
  • SHA1 60971cc4f9a57c3b6d6e64c5fe38624f55c72786
  • SHA512 65e726196da1dceeacb2811163bd2775dec4155101ac484058810e3b6a957cbb292ffb13d7efce2ec082b1e91bae1f5ec101b0efc7a15d49e0f408b5d119b3e7
  • SSDEEP 48:vIUnUGTlUUUKEU8UnUZU2UFU+UyU9UNUTn:vIUnUOUUUKEU8UnUZU2UFU+UyU9UNUTn
  • TLSH
    T1179161852B431BA53E3D9A2279DDC72C724685D9C8866FC5F0DFFAB04E88DCA6C44152
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetcredential_accessdefense_evasiondiscoverymiraiantivm

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (52548) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1behavioral2behavioral3behavioral4