Extracted

• • Target
    jaffacakes118_4b7fa5495748fde2d47dd6ab8e5573f9d1601916cfcaae9ec77d7089c88a4f45.bin
  • Size 54KB
  • SHA256 4b7fa5495748fde2d47dd6ab8e5573f9d1601916cfcaae9ec77d7089c88a4f45
  • MD5 8dc7792fcc7043f571a179362871bca7
  • SHA1 00f129ccb3694174ec132eb74388f79aff0faae5
  • SHA512 223e8e4b4a2b0ae1c8f68bc5ec72a288fce833cf9ce5b3f962db578a786f65436df53d8682493c5cb7a9d447b3e79bcea830e98a982fae6fa812fe1a5c97cb58
  • SSDEEP 1536:n+PzZTpoCr9FllguQ69pRCigdb7e0sOPTPNqLNouEr:nCdKgFl6uQeD38a0sYqWuEr
  • TLSH
    T15743F162E881A59BFC286F74C03747E743AA7647CE5A75073398CA62C8462471EFC8B5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetunstabledefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai ARM payload

  • Contacts a large (148735) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Writes file to system bin folder

  behavioral1