Extracted

• • Target

    090a706453921de56a8d718b1c97bdd5

  • Size

    31KB

  • MD5

    090a706453921de56a8d718b1c97bdd5

  • SHA1

    a355f71452746b1def6eec25e22d4cd880850e54

  • SHA256

    879b1a5e290511c3a8239b5f1589db8660262a4c285c04c38403c061951a0bd1

  • SHA512

    a411fa7f30d71767b083e213ede8ee82661a221e09befc9f65a4b60b48825a3d1f215954b3dc917515592776d2568134793904999b4e388b41bb0620d7ac004b

  • SSDEEP

    384:e3fpCLrsjHIX69URc+hmnulY1qHprFKt6zW8zZMpSPyE/o3SV8FB/da3lRWGVCzl:SfpWcehzJFYKWYGWhOS2ba3TWt

  Score

  10^/10

  miraiunstbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20324) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1