Extracted

Extracted

Extracted

• • Target
    zyxel.sh
  • Size 4KB
  • SHA256 a8bf7fd01bb4a16af2fa1b13165f0f2c4753c3271feac14690d4dc6bb3268da0
  • MD5 559885e87cb41d52cbacef943159c602
  • SHA1 fb3b3c80ead18d4397b4adebd0bd30c4bbd71fb4
  • SHA512 13b5534ee49663d969a1ded89650c7b2325ee5088012eceeb8ebbfba30ddae34a83133acc6ef0e6a0a755e4547c18bb3c5a0e9e163f73529a42f01104b8ed908
  • SSDEEP 48:vUhMV4kuoUq1V4KoUrHrWV4joUNoV49oUEpEEV4EhoUJkV4BoUq1V4KoUOZV4GoW:vbppWP9LBzOEpObLZKbsDNjT1cDYDbbu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  botnetunstabledefense_evasiondiscoverymiraiantivm

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (64513) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1behavioral2behavioral3behavioral4