Extracted

• • Target
    FGx8SNCa4txePA.x86.elf
  • Size 27KB
  • SHA256 0472f5ada6eabcfde2bad4374b884d443166f90c7fd1e8c41d518a3890e7b7c6
  • MD5 fd510ed576eb56b8e8c2b0d58f0741fe
  • SHA1 1cd032d062fa1d55bd41b1138902bd560d48d6f3
  • SHA512 44095f61b482321de9ab1e439852a3b08f92a68da25d3979d81b6b950727c9848995d1431c6a5f46476e5abb00a3d6299b21b8084a53cdf32d89d031b97f1607
  • SSDEEP 384:MsKpIDb1DFUbrJhFKU3g2TSl04dWthWtItcn/XdmXSSa6G52l9ViAziY0lJmx+v7:EIrjU3slz8hWt7/tmiSrl9XiY0lJm6z
  • TLSH
    T1BEC2F1D5356921EFC4C0423B802D4CBA70602DB48457B9FDAF133CBED59B468C13E94A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetlzrdcommand_and_controldefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1