Extracted

• • Target
    sever1078.arm7.elf
  • Size 261KB
  • SHA256 fe6c540c57cc17b28c6f26bde4cf06d7b1f2d274953ba9fbc76f8cbcc9aabe8d
  • MD5 46539faa7675496ab1fd3608bb0d6f4b
  • SHA1 da296ec7da6556ec54c62e65b6a02ee4603244f9
  • SHA512 0537470c144876e2e0bfc9e978b39ad849a49556c6c9c72d926761bd71ecaeb937f3d1bcae4a4ca1f26e05ffead1152b66c36b1d8f83fb07aa4fedade555846a
  • SSDEEP 6144:7WzaO+5d4cLcop9w6B5GfolAIHTn6slLiwS7gKmUL5j9Z/g0o:WTIdLcE9lmoPzVLOsUFj9Xo
  • TLSH
    T1444423FFA60A8AE3F0643F78FB75C290660FD2CB43417AA4736171A554F5E05836A349
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (22417) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1