Extracted

• • Target
    jaffacakes118_fcfb8d2e553e0b6c56800af50f7d583ab95f36974602506546f1979c49af8678.bin
  • Size 73KB
  • SHA256 fcfb8d2e553e0b6c56800af50f7d583ab95f36974602506546f1979c49af8678
  • MD5 72df5ba85d14d9029b04ab31bd3a300c
  • SHA1 50d46c8ad8cc414dd4176b6c9d9356897c66d36e
  • SHA512 0ee8fd67932d44dfba2546248266ac7b48f53ead0445d78950d8363c43dfa149d6b0cd407aae97d8cc0cb2ad8604f507109087dc4de01a78bc74f063bbe0ad59
  • SSDEEP 1536:oY1RjxAXy8dI0CyqSKr3htDZ+G6tk7eRfWS/S0WN+HT3m0qLzW:oY1RNN8drhqSKr3hdZh6t0SWSYE3mBLq
  • TLSH
    T17A730161DD436AE3D6794036EE9A484F977EA778C0D0A7723B084274F68752CA37848D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Write file to user bin folder

    persistence

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1