Extracted

• • Target
    8403c93f049e390d42069b1247a9d302e9a16ee4c6be5924b2de42f808d0c8c7.elf
  • Size 29KB
  • SHA256 8403c93f049e390d42069b1247a9d302e9a16ee4c6be5924b2de42f808d0c8c7
  • MD5 366fea08f5205675f9d0b2997b6222d7
  • SHA1 a66f087399f641e53842c600efe8731bfb798f04
  • SHA512 aaa369d948ff38594bf208ef1bdb42a4b734a9e5fa9c70d65bb2089dae6e84321d4caa2cf7a16f02cd2bc1876c0ea424478eb999fe50a99e7e9d4e22f668a8a6
  • SSDEEP 768:H0iH8FHtmpb0eJ7LI8GqRZLcbj+gYvQrMHFbdsNs3Dm8RzthLqp:HfHwHtmtvJ7SEoaQMHFH1RztO
  • TLSH
    T1E2D2E0F09D35A063D4ED463FDD2CC46B228D9078E17B556AC2CA650268FBB0C7993A91
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetlzrddefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20506) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1