Extracted

• • Target
    sever1078.x86.elf
  • Size 455KB
  • SHA256 80828752354b3a770b7c63f46006334fc705c718d40cf3e1df1dc5a4f0fdf043
  • MD5 1623ef1f9b9c4dbdd46170805d63270c
  • SHA1 a1e8bb06a9ffa6d0c22a568a556fc448a447e55c
  • SHA512 e0257f75ddc88e62abd428db980e8d70aa9756b39df674037a9added10eb29c1200c7819ba980412904028934f7c4188d6e58d6953c4b5d7c439ccd1da308d32
  • SSDEEP 12288:uG3jxoLetDOGI0D5DQFZYe2rCuXZK0MVMnEMlV:uG3jxoStDXI0D5GY5muXZbMVKl
  • TLSH
    T1B1A45B55EBE3C8F5F41745702027B3374A36AE395036DA87D7C8E6637851A82D32E3A8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (23370) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  behavioral1