Extracted

Extracted

Extracted

• • Target
    l.sh
  • Size 4KB
  • SHA256 70acdfcafb548a2c85c3350398b0f6d629d9134b16f0b2df2e627a36f521f643
  • MD5 8030b6bdf0f8951ef3768c64ba667238
  • SHA1 d62dc2042638c5a814d10adc4de073cf1e895f4d
  • SHA512 114387404be9ea949d37da4655731feb4ac26007aca6254400522e4d561e8b23b9bb352dcbf2732ba81f5aa0d1ec4f2d3490d75fd358b224348deded009b26ce
  • SSDEEP 96:zJgRXmrVdgImxt4uaxUQb5XlrLqsMt/z6TsMOc:zG2rVbqq5Xv79
  • TLSH
    T1CD813ED6BC32C9B3B5EAC474BB9E7244FB87856E09543A02744EBC74670C56CA03E399
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetmiraidefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai ARM payload

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Deletes itself

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  behavioral1behavioral2behavioral3behavioral4