Extracted

• • Target
    sever1078.mpsl.elf
  • Size 597KB
  • SHA256 ff7c87181c18d93442d060b294fb37636d90bdc5c669f2c156e6e18aeb610636
  • MD5 ac0acf4a18e19bf8d89a17c965ed94c4
  • SHA1 436c62d6c1f6152bcf0d68ef23ac7a7f5ae68fd1
  • SHA512 faa994a43d77b437eec8d5bf61d954438c3cdff8f62e2a65a6c1ae1ccb8ca344838132508ce7f699bb378b299f4fccd082674121a162edce66ab0a3f44e1438c
  • SSDEEP 12288:p0z4fA7Vcp5yaNHNTs6nD0BM2U1eQy2V:pC4ccp5yaR3D0BM2DZs
  • TLSH
    T1A3D45B066F510EFBD82FCC3746A8970A209E5C4732957F72767CE908B94A34B5AD34B8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20162) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  behavioral1