Extracted

• • Target
    zerobot.mpsl.elf
  • Size 664KB
  • SHA256 14f6f4d0b7912204d99d1406a1233f8aafa7bc494d9c5167282804308ef3f33d
  • MD5 04db115a2bef99918b00cb4c27f9b9a8
  • SHA1 dc0455d0004b966a2f37343494c19fd677bb3bcd
  • SHA512 640f1f2f716ca3961bedefd289203a8e9d7607b2faf1286bdd5f39d1a3a04ed7bcbe4d7dd6cfcae036f504dd959e06edf8f0274d63830a2356fd55d3ab68b38c
  • SSDEEP 12288:kZ7QHeG03wkfJtF+3A82STsNF9kuW5nwNUXd4YS:kFqeGYfJtF+3AHd9ku0kUXdT
  • TLSH
    T135E44B067F610EF7D42FCD3702A99B06218E5C4732E97F727578D908B98A24B5AD3878
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (42408) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Writes file to system bin folder

  behavioral1