Extracted

• • Target
    2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf
  • Size 29KB
  • SHA256 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b
  • MD5 2370ab19b2059486c95418a8a3cf39b9
  • SHA1 7fc6b14be827ad76486e384237f0fa16baed84a2
  • SHA512 c5c288742d12e4eb24e2544242c0f4ec00182c3826a4a32d1102e6928fcd4d94e0c22d684baa66075e9b8e0571f47d3b744190d1abde719b7002bfa9def86db7
  • SSDEEP 768:H0iH8FHtmpb0eJ7LI8GqRZLcbj+gYvQrMHFbdsNs3Dm8RzthLqx:HfHwHtmtvJ7SEoaQMHFH1Rzts
  • TLSH
    T16FD2E0F09D35A063D4ED463FDD2CC46B228D9078E17B556AC2CA650268FBB0C7993A91
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetlzrddefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20155) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1