Extracted

• • Target

    614-1-0x0000000008048000-0x0000000008058900-memory.dmp

  • Size

    64KB

  • MD5

    032f7675254fc23311040f989d7d7ed2

  • SHA1

    1e1076bd6b113815b7da0debe59d06e6acb81175

  • SHA256

    dd6deabc1b95677532ed2299b42900a1deadfe83089f93b109b4f0ac0b85ca57

  • SHA512

    e159a1159c2136836b4b72f644026e12e545be2a8ed6f95da8f3506473016ddc27c33363802bfeb205d45227d165499b63f03c266275869a4b9b0c7600a0965e

  • SSDEEP

    1536:sZBcKRTVIAAhCmn80ssK+nWSWuW/SNMfCwS6Q+Y4G/:IBcKRRIA6CS1K+nWSWt/S6fCv69BG/

  Score

  9^/10

  discovery

  • Contacts a large (20138) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1