Extracted

Extracted

Extracted

Extracted

• • Target
    zyxel.sh
  • Size 2KB
  • SHA256 6d88bc49958c11f8c9c834e4c2be38837c113891a6471e4f7d4dfa1a4b8c5ce3
  • MD5 dbe6a2e5751a0b10e584116b4e951b7e
  • SHA1 9d7dfcbfc7efa6410addcc7b956b718debcb63d6
  • SHA512 b28e68bbab8db1b3506794271ca1134fa143d292473f2f9af9ef5862b5799bb9e294840b77e527898698668d8311896fae56d60a4a0eb504c41053e27b705a41
  • TLSH
    T1C6517DD833164ABA7FF19D53B5F58A1876C0E4A15AC26F46D0FC78BD664CF0824A06E2
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetsoradefense_evasiondiscoverymiraiupxantivm

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai ARM payload

  • Mirai Renesas payload

  • Contacts a large (46408) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2behavioral3behavioral4