Extracted

• • Target
    sever1078.x86_64.elf
  • Size 198KB
  • SHA256 e50df34dc2660c9cbd36c082189d5da1556ce4f71c48b4a4a1fc25edc44be406
  • MD5 9f38fbf3f5a9a5438904595166ddff00
  • SHA1 826e43cbe6b26c78f0c74e3ad8ad794aa2c33200
  • SHA512 64a0f929210c321a22c5c90948e3cebe4b9946abc93cff957bff4c458d30473dd4d3a0e1bbc7ec304aa125b3f40bdd866603bc921b043659e2fee7780960cbec
  • SSDEEP 3072:75ZLV9+rPFAqqIPmV5ErNenMoDliRbURC8gQP7H+30BTpd4DmttwRqz3C:7/+rP2qqIPe2YnnDli2R7eEBdqKtdG
  • TLSH
    T1401412B503C3EC27FF920376F8AB9B8C762BD59DC6D961048691F15A8766830C7E1C1A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (47367) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1