Extracted

• • Target
    sever1078.mpsl.elf
  • Size 237KB
  • SHA256 64a4961f31e19f9c4c1dc493b40939e00cffcd996f07735c42eeb09a6b919b8e
  • MD5 f9b23d1c9f5f8de1eba326b8e85edc0e
  • SHA1 4998502bb9225eaa896124399569e7ebf0331268
  • SHA512 822442b0a33bbd5e9159ad3a58ca84f31391236dc39415815890705534bf1087b79a443e8b0f9f824687416e48f591ff4fb8becff57162ab9021fbe859f722f2
  • SSDEEP 6144:o2ONSMTz1dz683ayTTHVbYyWC6ZFUjN8JEgsU1aFyNtt:o2YSoTz68VTTZFfqFUuavU1aFyNtt
  • TLSH
    T1B634234BC4AA0807A4DCFBBB026CD5BA30591F3E0B892A9693213C2641B5DED538D7D8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (40018) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1