Extracted

Extracted

Extracted

Extracted

• • Target
    d2893eef0bcf0cd0c9af00f31b8d908ab3ec28323c57e560328bf9bc29bb83ce
  • Size 3KB
  • SHA256 d2893eef0bcf0cd0c9af00f31b8d908ab3ec28323c57e560328bf9bc29bb83ce
  • MD5 9c61ad10da51839ca0efefc58011b880
  • SHA1 fb8f46a97f2c5754b09f86a8255566067dcb574c
  • SHA512 3405b1b29840e2c9f4b9239f06b5eb534c35ac3672141a6842b014400affd9b80123ae5d171348e5b54c3a5c2f5ad29c1b6ed99b9947043534ba85072af442d9
  • TLSH
    T1E4711D8B210E05725DD2CEA772AF031C2DDBA4A9D4CB4E0699CC3BA5684AD19BC3C573
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoverymiraiupxantivm

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai ARM payload

  • Detects suspicious XORed keyword - Mozilla/5.0

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4