Extracted

• • Target
    jaffacakes118_248b92aa4222df72b89251459753cf4386c8e9cb0acea7f4f7e71936d5140505.bin
  • Size 77KB
  • SHA256 248b92aa4222df72b89251459753cf4386c8e9cb0acea7f4f7e71936d5140505
  • MD5 e2da73d9371ba07f72e093361cec7580
  • SHA1 f2b85a731cab2c6313cd0137e5b614000464bfe0
  • SHA512 aeff392c6035dca8e915a99e78a88aa61aefbc8d0268c6351e9c41e8344d588e5eeb2e9cf20987f0ab1efe81169a48eb32c82adfc3324bd921657eafaeeaa89e
  • SSDEEP 1536:eERPvgRkt/vdGJ8C4wZDrOFntzAAEre7wKp+Yeo480n+R54CJX3+Qnouy8HyI:esPvgRidBGOFnFse7wKMn+RSGH+YoutH
  • TLSH
    T10973024783A98593C4C1823A15AB1FDCCA14800F490D9EFEEED65D6B9CC6FED6A110F1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetlzrddefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (205424) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Traces itself

    Traces itself to prevent debugging attempts

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1