Extracted

• • Target
    jaffacakes118_8fb20ebf4d823bd47d5a33b2fad496e70b2c8c3ef088aa4aacd1dc6b8f25e319.bin
  • Size 60KB
  • SHA256 8fb20ebf4d823bd47d5a33b2fad496e70b2c8c3ef088aa4aacd1dc6b8f25e319
  • MD5 635a65d2cb1b12eaa1478782051fca7d
  • SHA1 25253e769c86508cd11b55b93237ad66759986a7
  • SHA512 22f0f13dd22bd58babcf05c151ee96f1fa08e5f9a3f2987a102bfc3d7134039c176de6bc6b0fa94416748ee0ef577e4777f501a1477da24406f446db5c8b3bc8
  • SSDEEP 1536:Z/h6zaRxIvggqbZ8elV/mMjKkvLoueE/nouy8tyXZ:jRx4gvZ8er/mMjxrfvoutYZ
  • TLSH
    T1835302251E62AA82DD2CD5B762E432EE75CEC5AD9A44CD73FEE4A5518835C3C4400FCE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoverymiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Write file to user bin folder

    persistence

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1