Extracted

• • Target

    31143d7765e618b485845d2c9253149c

  • Size

    30KB

  • MD5

    31143d7765e618b485845d2c9253149c

  • SHA1

    2ac02f632b0fc40db93a2ca3b5884e6098fa672d

  • SHA256

    e3968663b9922329c3992dd0f0367196db463ef5b545f30108ef08d3b5bfcaf9

  • SHA512

    22f5d44024d6ebe9054e1ae8424fb9f1e4de160b27fdb24cfd1940427e990ddefc4321aa8e4952fb3eb462a678ba63756bef1ed6ee88da043dcef41e66dd34b9

  • SSDEEP

    768:tyvYLznDEB2iC+sDqC6NtxsLLd9AtQBgX4JgGlzDpbuR1Jg:oYnnDEBI+smAd9AtQlVJum

  Score

  10^/10

  miraiunstbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20141) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1