Extracted

• • Target
    kaizen.arm7.elf
  • Size 246KB
  • SHA256 4f7c33e36a86daeecc7f465caae0492c7da4bf697eaf38e1bc11dc9c15cec142
  • MD5 20b44b077cad4f41bf448ae7db8244c5
  • SHA1 52a2c31f0c43d111761fffbe77f270ee561a8cb3
  • SHA512 e1ad1f3ec3ab897414b68087f04f0910ad765b9b8c5868327c2f8b1daef5e8d23c7d684870d5b224f2441298d06d1d4c84fd0448c7a61cbd7ec03d6d825ea163
  • SSDEEP 6144:AaKDw6e94AuwuuB1KVad2gPy5MDud4HaBkb2mvQJKx/6F2eaY5y4KDOHRrLDVgJU:RKDw6e9hun9Vad2gPy5MDud4HaBkb2mI
  • TLSH
    T1DF344C46BD808E13C5D527BAB6AF414E3332A768D3DBB2068D186F74378766E0E77205
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetomnidefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (1049103) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

    persistence
  behavioral1