Extracted

• • Target
    sever1078.mips.elf
  • Size 609KB
  • SHA256 b507655ae627029dcd4ecfdcc8b73cc6b85b93c3cb44beec1ffdf28b6fe1adb1
  • MD5 1121224ae826596e85d1d4cf9a8f4c47
  • SHA1 3356e1f59fe75abe5490222b27f032d39ef291e2
  • SHA512 e2a0020e843a4d005b16eafbd40332234dc047823a013387f8c96a691be594911b08d1aae7bd24d5c640d4e348c2957c04d9d85c42feddde685b7cfa15964e4c
  • SSDEEP 6144:FhbH17jRCSOxc33GqR2rkY+xMUs9LsvFAdyA/qIpQwM30RmiNb07H/Fb4uCIYVKs:FhhhXOTGFsyvFcpA3mVU7C/
  • TLSH
    T1E6D4F85A6E619F3DF67487718BF38A30D26A639207E1C5C1E1ECE1090E2029D5D6FB6C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (44000) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  behavioral1