Extracted

• • Target
    78815d49a8d36e4f9ebc8d40542c5bb2dbceee43914045309402ee9f5a104740.elf
  • Size 23KB
  • SHA256 78815d49a8d36e4f9ebc8d40542c5bb2dbceee43914045309402ee9f5a104740
  • MD5 8b6356c5f8e862b15560f960929142e7
  • SHA1 16cf359b4b3c0badb14f481c0f241c20d84fc61e
  • SHA512 92a7705305f2dd22163a0c35ca9067a2515c7c03f09542edf7e5293ea0c3de4798c118f96d51bc66951b52f6e6977f6f7d1609181d8a31402442c9c296bd027c
  • SSDEEP 384:eb34k2kJrd/aTsR2aj1IaTGC0OfEBM6FR46tZ2BtddpDBU8cKLHw4ScTf5yhy+xY:u34yuT/7aTGXTuYytHHT7LHFR1+kaJgP
  • TLSH
    T1DAB2D0E9024410A5F9FEC17C4F9787813E984D72E643AC9FC5D7AE199A17091BC83BE8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (39524) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1