Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    ok.sh
  • Size 1KB
  • SHA256 985bbb5584b3d2f973a0933962e4c9d6970c67bb8311f19e2bed5d831c484844
  • MD5 de8544c2892638320b08be340a2b2b59
  • SHA1 87a657a33a9a826effe7377709855dd9ac8c56f0
  • SHA512 02585bd1b66c8ebf4e31b2ca845b79a47dc53cd3243cbe0a1fa23ec37942a9b2617fda355f5a95b3885b00ee7e4fe95b1d8cd42abb199a8bc71790c843de9310
  • TLSH
    T1B83194AF10101A315103DD9EBBB23449B28EA4EB2C9FD7E4DD094D9A91487DCF165F0D
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetdefense_evasionmiraiantivmdiscovery

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1behavioral2behavioral3behavioral4