Extracted

• • Target
    Sarm7
  • Size 56KB
  • SHA256 2689d3075aeac149823891eacf4f3f049c577a59276d38352993a6a6a338be22
  • MD5 20f79c2e1b9f2dfdf6a642f1196d63bf
  • SHA1 98caec6d65f1fd9a0a7d9a7224a2097204e695e4
  • SHA512 a34e610d4daa0267a912f4cd487b1ab45e63c078bc4116410d20475be4e3d3c0b7029799a33b9650c108bc5299ed0c02d8d6e3808758efd41a35dab4981a5215
  • SSDEEP 1536:3TRNAFDOnAiGrVlmknUwvLzLUAdHBhEOD/JEcgzv:jvxndGx/HLTdHBCO9ETv
  • TLSH
    T14A43F15859758DB05BF0E234E94FCE83131E7239F1EC96D982F4214FB8D260227AE283
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetcommand_and_controldefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai ARM payload

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control

  • Traces itself

    Traces itself to prevent debugging attempts

  • Writes file to system bin folder

  behavioral1