Extracted

• • Target
    jaffacakes118_11e822526a32a0ebafcae407ef30ddef4fc3b3a462a60cd1a0fc04ab85433fd8.bin
  • Size 72KB
  • SHA256 11e822526a32a0ebafcae407ef30ddef4fc3b3a462a60cd1a0fc04ab85433fd8
  • MD5 bc8d2e8538bd8df9415d48cec4312af2
  • SHA1 767eb9b31b265f1f30c21c022ab7bfe7d6512811
  • SHA512 dc8b5e21c003b70a0d11e5a1c73312f3c900d64d7d602087ed9964d01a21b4e013cc3b6ad47c1433207798e827bdb329db6cc26c793bcbdeb833dcec8184516e
  • SSDEEP 1536:S8jZmEPu9t0+3tHJxpI3tSAfmUipDzZDjJa+1QSwZ+GQLVJuA:HHPMagJxpIHfMv5NaqO0LVQA
  • TLSH
    T1ED730269ED8B30EDFE4BC63842F583756950231AB4A3C8D93041E7E29F1D17179A3E91
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoverymiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Write file to user bin folder

    persistence

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1