Extracted

• • Target
    sample.elf
  • Size 31KB
  • SHA256 73aac0af339dd51570f2804e955afd8ea4ef349983684e0f56dfcedce87c3067
  • MD5 1e4aa4d1861044fd71dce898f43b9203
  • SHA1 945be78d4ef442d6989cc3b100b143c53686a84d
  • SHA512 4f99080ae3c20825e776a787e731c473206976a956de406da6245a7e8df556abc400e99366843aad000cdc8611b366b9e5a3fda7b01fcfed19facf0282dd3566
  • SSDEEP 768:jcrdm2orYv3psMQgQUzzIq0X9aIp09MQIoi1McJTcS1jNHJqnbcuyD7UGQRj1:jccrYaBPoceTi1bJgS1jfqnouy8GyR
  • TLSH
    T171E2E03695B44B07F86F26B209FF7CC14120C24C58A559219EC8F9B6257371A8E1CBA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetunstdefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (27061) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1