Extracted

Extracted

Extracted

Extracted

• • Target
    thinkphp.sh
  • Size 2KB
  • SHA256 ae99c151bd3a18d1f9e04dd686c86cfa8a9e6d094e23dc7dd151a732403feaa4
  • MD5 c785fdcd9c8c02b28a26c83891742aa7
  • SHA1 9f8279ac2cd578498d65ec0a0be4c2b59f1584c0
  • SHA512 26b88c0003ddb88f30942acfa80944aeaf260653ba47bb155de1b8bd1f81a1ccbaf32a7ca93b29470ffc262538065f43b0204c4f105eecc2e57ba3ad6f5e1281
  • TLSH
    T1825195D573524A30BFF19EAEB9F69424B080E091E7C5AF05D5EC65FC8A4CF0826D8692
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymiraiupxantivm

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (46067) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4