Extracted

• • Target

    1b816a4735659651887195c4670b8ba5

  • Size

    29KB

  • MD5

    1b816a4735659651887195c4670b8ba5

  • SHA1

    5ed42083835d28c2c345c14cdfc7b88d1a5922cf

  • SHA256

    afd0278566518fb3d91fb30efaac89f0712b1ccc4a606834875bd6e2465016a5

  • SHA512

    2ccc36176c92d75fe30ea3b0f9a52b7c89ac2f4d3bb2c359385aeb2f79ee0c4d73bc8d78623341826e17beea6f95fbfe6b14fb8126483468e93f63d8f809b71f

  • SSDEEP

    768:zHbKO/gkgnb5i/n1EbuA8+4iejlMPnnJOrZGKyXMsO8MbJgGlzDpbuR1Jm:qOjgnb5i/nqbudwnJcQcs5MRVJu8

  Score

  10^/10

  miraimiraibotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (19954) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1