Extracted

Extracted

• • Target
    e1238a13a4fd4de7c62dc36f45e6d27bcae8d47b51a2ecd5e360a2e7024bf2b8
  • Size 1KB
  • SHA256 e1238a13a4fd4de7c62dc36f45e6d27bcae8d47b51a2ecd5e360a2e7024bf2b8
  • MD5 221aed77b1a1131d4f123d5f003998ff
  • SHA1 fdcc3d0191fcef2311ea8bce9a0904e50ae6126a
  • SHA512 cb96cdb9798af8b8ac5144a95d9b6b9e017a770acfc08e54ba047ae564abd13a42b808870db1afd353ff2004a743e171c9f68c388149ccf087d0c7937fc97603
  • TLSH
    T13D21364778921031B6CDD43A572FB380B242601F6A30EF1C364FAD711F8C5A1F9EA6A4
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoverymiraibotnet

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai ARM payload

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1behavioral2behavioral3behavioral4