Extracted

• • Target
    jaffacakes118_7939bf7ab0f9efa266720731fa6fd5ef8edbfd5c619c5c8b3c37fee9c9e86a9d.bin
  • Size 76KB
  • SHA256 7939bf7ab0f9efa266720731fa6fd5ef8edbfd5c619c5c8b3c37fee9c9e86a9d
  • MD5 9731ab2792e99e09654eb58ebeaa32e9
  • SHA1 31ba90b2538fd6378b190720217d0b2fe3846353
  • SHA512 96de82139d4850ae3cd02d96e1f26fcc9b03f1eb48fe1b220b697f984a9bb4e9ba0cdcba439c34c71315a29ca6a0a3fe3ffd9a6e89aec98398b575deb91948b9
  • SSDEEP 1536:C/oLBrsOOtjUETTE3bn4sRyQGepJpxMrSEilQl1ZUw7mF6uJSnygVJuv:CwL5sOOOEY4i1BJzMSoLqw7mFtKVQv
  • TLSH
    T1D47302306B0406FAF8EBDA7DCAAE0EC4161C095235D9DCDF7A02FA46EA456751CC36D4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoverymiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Write file to user bin folder

    persistence

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1