Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    bins.sh
  • Size 910B
  • SHA256 dd47b5f7dda2ade9c11ef05158d62d5d5f63bc909cfce42a03008f7e1b1928ff
  • MD5 70301f60cfa959142e2d21c4538330cd
  • SHA1 1559bd551946945a3cafcdb5f3761edef8b194d2
  • SHA512 7c49014e7c5aa9487c022488e9da3d843e7a8f7f2da93d3810349122791561d0c03af121c32f766ca5bbcc73c59149e6d3abe424464e2b593e16378f4862a9f0
  • MD5 SHA1 SHA512

  Score

  10^/10

  botnetmiraidefense_evasiondiscoverymirai

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (4008) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Deletes itself

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1behavioral2behavioral3behavioral4