Suspicious 80% linux Download

main.e500mc

Mirai botnet binary

Mirai bot command-dispatch failure markerProcfs process executable path fragments
SHA-256fa18133093a41ea61ed1d13f408697cb8d21747ce041dce413b1997d5e367a7c

Evidence

Mirai bot command-dispatch failure marker 0x11a24–0x11cc4
3 more rows
0x11a54000000002e0000002f76617200000000......../var....
0x11a642f686f6d650000002f6d6e7400000000/home.../mnt....
0x11a742f72756e000000002f726f6f74000000/run..../root...
6 more rows
0x11ae410011ac010011ac810011ad010011ad4................
0x11af410011ad8000000002f746d702f2e4b64......../tmp/.Kd
0x11b0461745f746d7000002f70726f63000000at_tmp../proc...
0x11b1465786500653530306d6300006b65726eexe.e500mc..kern
0x11b246661696c757265000a000000382e382efailure.....8.8.
0x11b34382e38002f62696e2f626173680000008.8./bin/bash...
0x11b442f7573722f62696e2f62617368000000/usr/bin/bash...
0x11b542f7573722f6c6f63616c2f62696e2f62/usr/local/bin/b
0x11b64617368002f62696e2f7368002f757372ash./bin/sh./usr
0x11b742f62696e2f7368002f62696e2f627573/bin/sh./bin/bus
0x11b8479626f78000000002f7573722f62696eybox..../usr/bin
0x11b942f62757379626f780000000010011b38/busybox.......8
5 more rows
0x11bf4ffff0d40ffff0da4ffff0d7cffff0d90...@.......|....
0x11c04ffff0d68696e6974000000002f000000...hinit..../...
0x11c1439342e3135342e34332e31320000000094.154.43.12....
0x11c242f6465762f6e756c6c0000002f646576/dev/null.../dev
10 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.