Extracted

• • Target
    jaffacakes118_0f17b91bf13550086de8c2db040ad47b46dba4d058a4da2d608191a3f5ab052f.bin
  • Size 152KB
  • SHA256 0f17b91bf13550086de8c2db040ad47b46dba4d058a4da2d608191a3f5ab052f
  • MD5 71d8189bcfc42d2799debe6089046526
  • SHA1 dfffc5d0b828a46a114d5f54883caf561bb636d6
  • SHA512 06ab742394922c24b69446bf9bc981aaa57c481eeaddb4d7dc093838ca53dfdfee2d43e5ff8bdd018dec2591292c540e64383955e5b2e3181bdad2f757141a35
  • SSDEEP 3072:lLeRKOR9JXB0tJOvPBMclMHnIE9SVJTNMDFu3koNNTOTj+PYyDov23z1MV8w:TODhB0TOvZzlMHIsSVJsfTAZMV8w
  • TLSH
    T174E33B81AA43DEF7E80711F011B3AB324A72F83E1837D982E779BDA1D9406D1D5163AD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdiscoverymiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (108291) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Write file to user bin folder

    persistence
  behavioral1