Extracted

• • Target
    sever1078.x86_64.elf
  • Size 458KB
  • SHA256 0ef31bf5bf64199ba9b2c3f0b008c9ccc95126efb98346c034c6f844ab7a3e60
  • MD5 a9519822036ceafa65fd879a44ec71df
  • SHA1 f9584226f9f24ecc311c663bdbdd7c3c355f50e8
  • SHA512 c7d6c2c835e621b55ebb82dc1ec44f910950c14ced1944ca7fd61dc30b6e3acd50fded0c975cc3923b022004861d7c47ab40fa6bcbc0f7bc4435943571cb585c
  • SSDEEP 6144:PivHNlDaR4BmKQnnVhMWCp5SriVepDgbj5+zUdtikZ6UhOWHv:PADy4BmhVxCrloMszGdHv
  • TLSH
    T1D5A4494398D844FDC499C130478FA2379A72B46C1138BB9B6BC1EF663D25FA0A72E754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (23368) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  behavioral1