Extracted

• • Target
    jaffacakes118_e4464c6516b173436457cc20063831acd31d1d791ac435425b60b534b275c14b.bin
  • Size 81KB
  • SHA256 e4464c6516b173436457cc20063831acd31d1d791ac435425b60b534b275c14b
  • MD5 f3e749cecd774295d56abf4bf42c9f08
  • SHA1 eeae457d91b19dbf2935a0c473ebab83006b1057
  • SHA512 9c20f02b141090c55ea6573cda926789c3cc36b473e151fbd55e7a0fd8310de4ce13b5b58c0aa814d9612b72341ae1c83767184d91aa9ee016a4d2dfea2ca2f7
  • SSDEEP 1536:gzKeRxFVnQppWHlFJ2+xzrYpS4QzD9q8NulOTYkJdLWRStzPJYmJu0FMmG5JzOky:neRxLcIzPIpS4YPbYkLWRS5MFZOkOou7
  • TLSH
    T1B2830242C5F64646F4B501F964BBA84E5920831FF5508162ECFFEE948D82B35A74CE2F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetlzrddefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (206913) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Traces itself

    Traces itself to prevent debugging attempts

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1