Extracted

• • Target
    sever1078.arm7.elf
  • Size 262KB
  • SHA256 358d91e2c9db2715dffad77cbd054d3f628039bfef32ee94b427da8415c31641
  • MD5 aa0f89667a0f1c749334fba9b03a72a7
  • SHA1 ea61fa4b16221f06b3034cf73f59f67dbaeccb04
  • SHA512 ee00aa307c5f454ccc6e4300d1be3662d3b5fee0050f6adfdeef0e890bbd9a318ba6309004712f226a6a543e11ba5d071db907517107f0ba2248ec4965151071
  • SSDEEP 3072:/XZ61jr5fG0Rh+fjrsT5JHwS96BBE2DEG/Oygvr7nLzyh9HhamybM6Sob+EHiZdY:ajphv+fWwhE1rtXwBa/mbiWYfnkbZ+jd
  • TLSH
    T1AD4423FCCEC7E21BA3051B319B18C332AE5853C88762A9F7955925DC02E717B8BF1519
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (22415) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1