Extracted

• • Target

    4282f9294a9f725a472b69234cb91930

  • Size

    28KB

  • MD5

    4282f9294a9f725a472b69234cb91930

  • SHA1

    77ac50a7cb5840347443cefd0f48e501ea579270

  • SHA256

    9d2f414deb6916234cdb65f3fc0889997f0d759fd77bfcade0f736c3c0542825

  • SHA512

    9d69a7fc5ed5eaff362bf329a6e4daea5fb4086ef04826bec5e6107783e33690a0aca150ea1fadebcc38251221a13f8359ec2e647cdce22d543d11f43468edc2

  • SSDEEP

    384:5k09V+bMfjinBcU6kJRdAWOGBVjJSyxLdFHbMx6lhPDUbGH1RWGVCz0NvkO:5k0v+bM7iJ6A1UkHbfUb4jW2

  Score

  10^/10

  mirailzrdbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (19861) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1