Extracted

• • Target
    sever1078.arm7.elf
  • Size 267KB
  • SHA256 81e2e6b4186ee43c2bd02f989d6e46bf439a224b83c57353df91bf7f1efb8f75
  • MD5 2b009d34b8717e2fa544ec7ac0b96270
  • SHA1 c9926a409257ce1432e166af95ae40ae3bed3f67
  • SHA512 0d6267b8fa3fe275bb0e7cd74ab6cbcfdd4f30c9cfa96634bb21bba4b7646eece3ef3f4abce5e7821ffd71845119b912fa953511bfa07954f41c0099646968bd
  • SSDEEP 6144:hyuDRJUBwHzZvAkZJBrpn30ZEWLDx7oiaFcvqwNk7o6DvZuWhg3wJZkSCQ:DDPUBwH2kllnEZf97oiuciuTWhg3wJDF
  • TLSH
    T1574423D446A3E70BB878793AE51391513205324C9BEACFCB14F4819922F2DF727A616F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai ARM payload

  • Contacts a large (45138) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1