Extracted

Extracted

Extracted

• • Target
    0cac28cc7f788074afad9190818503f3a5b5c0033a68d2b3281b130a5bfa3e21
  • Size 4KB
  • SHA256 0cac28cc7f788074afad9190818503f3a5b5c0033a68d2b3281b130a5bfa3e21
  • MD5 6acb53141a30c43bccb1a35ad809f9f0
  • SHA1 2040828b8c34c5afc6a121d428d95b9ba9c3eeb4
  • SHA512 ae7372fd1f34076cef9f22887a937f5977782a04b50c415b3e9ccf086333ce225542ace185cf8984bb859111bfd1e0600fa0b429833d2a50a7fd12e8dfd8dab1
  • SSDEEP 96:tOYPYdYLY9YUYOYkYpYuGYP/QTY2YxYrYfT+8KZMA9x:tOYPYdYLY9YUYOYkYpYhYP/aY2YxYrYM
  • TLSH
    T1219192F1FCB0C772B00D447A724D75A44DC74D7B69A838784856ACA06A4CE2EA25CE7F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdemonsdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai ARM payload

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Writes file to system bin folder

  behavioral1behavioral2behavioral3behavioral4