Extracted

• • Target
    b3astmode.arm7.elf
  • Size 45KB
  • SHA256 5659ce381264cd5a8dbacaa30f09466acc628aa45f51e6e24165f68a3e3dc162
  • MD5 9db3a2fcd721de930c1973fedd5f3e26
  • SHA1 9424f4d4c43ed5bd0df2add4070286df1b594df3
  • SHA512 6957ab27eacbfef51f235d6be6f84eafc85748e59b40ca8d1118923515473e7817ac7e47d3e81b6a38e5353026d88c00b93e81b89ac5e5e0d216c998b0ea23b9
  • SSDEEP 768:CxYMepiDVs7k6p/CS53LWIBv0CxNYl1J2KlU9q3UELpTYAcSBj80cGzlB7ll9ORC:CxLOMVsdN33LWq0CElC+9LeAtNJT7llH
  • TLSH
    T17B230265D23A8EB1DA90053BE9181DDF50839775CC9F31B7002189B835FB78D6DEC9A2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetunstdefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai ARM payload

  • Contacts a large (68016) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1