Extracted

• • Target
    sever1078.arm7
  • Size 278KB
  • SHA256 5680280927dc802f96a4ba389780ca9597828b97ae957ef7dec27ff06567b657
  • MD5 f93f40bc65ba6d94f650cbab193edbc6
  • SHA1 bca4e6a4f7f686b79cf40fbe5685b23af70da36f
  • SHA512 df655325232839b86ca09efac59a8b8b356242c42e6571a7a1231c7ab582f593121b539b5898996c7dbb8b3f3379f8999d7678fd3d01dc898cb17f5c08c7ad3d
  • SSDEEP 6144:bpq9BRm4HcCt0R4gkD3ZEIse8jVcdp1EZAP5KRYVJld4qm174eiTWtXWKn4wa4:GBRm0NCRkDJEOCcqUgYrl2qmR5cWsRY
  • TLSH
    T1005423ADF1C44B1178586A645FE6FDB12B10A3D13BEB8777E2A2304184FCCE79B16442
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai ARM payload

  • Contacts a large (44771) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1