Extracted

• • Target
    sever1078.armeabi-v7a.elf
  • Size 624KB
  • SHA256 6a80d1e50fdf7a5904252c5b386dd94eb8938a9e73a1fc3d780e8933c19333dc
  • MD5 742e2389fdbbf657daa2bbdfc2178b75
  • SHA1 81f5f4e039250e4657b75a66af4d30e772e6e36a
  • SHA512 c4ab02cff94a5fbcfb488509ae7e1e0bc71e888011f40b6f5eb70818ed81b052c0807f3c4e6ee1b55fde428c876296d75007722f596ca29342cf14d9466e2b22
  • SSDEEP 12288:76FX8cuH6VwnqVA725cfy9Ybxu38tyDgjCNZ7pn+7Uue0gQdUiXddzQq1OZcdTai:OZxf7E7UurUivh14MOst2S
  • TLSH
    T189D46B4AED408B57D4D11BBABBAF524533235BB4E3EB72074D0CAB743B8699A4F76100
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (22258) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  behavioral1