Extracted

• • Target

    249f678340a7a450dd69b7c60f33dea7

  • Size

    52KB

  • MD5

    249f678340a7a450dd69b7c60f33dea7

  • SHA1

    f5ae5c2c7e462dd72f530b76374cd73d70b2ee2f

  • SHA256

    c8c74a6e387f2f0a7dd5c15d9adaf8acf039f65daa513b241684d4ffa5e852a1

  • SHA512

    e5b7b22c11c06a7e81f02c11a87e60dfad881fc48382f763cbb4541ee53c45a3f07a91bae797e32a2d70d8dbf028dbc84571e9ca99decdb1eda2eebec5b14ba2

  • SSDEEP

    1536:HvfyZF83ujA+bj2ju1y/aLSVaMMYj8xJmm:SZFzjlKuwaL0aMMYj8xJf

  Score

  10^/10

  miraiunstbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20605) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1