Extracted

• • Target

    2a51ccc08b8e6c3596d8c872aa6fd552

  • Size

    87KB

  • MD5

    2a51ccc08b8e6c3596d8c872aa6fd552

  • SHA1

    0c4cb36c43649d6aec60299430836685263e8028

  • SHA256

    3bf7aa4cbea7cb2f21a70dc422da45d3ea1c743f734de545775b565322edab63

  • SHA512

    e5b38fb87d1610eeb32aace64a671f9dd9217cb4271fe4b45a233c15de5b32191a21769258105a8632f1e3a40164512ecfc918f6c16173ff519634b80a88e5b5

  • SSDEEP

    1536:1YRdsnDd6C6gb/ZVyDYjMbwqZ9f0vfwW9ufY1C+KBtyRirfXDOiOb3J:CHsnD8/gb/zyDv9f0HD9FC+KBtyR6/Dk

  Score

  9^/10

  discovery

  • Contacts a large (20342) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1