Extracted

• • Target

    37c54bb52007ed226bc00132d44480b6

  • Size

    157KB

  • MD5

    37c54bb52007ed226bc00132d44480b6

  • SHA1

    c005d0fddf79930d68040bb91d6cf09f68160efa

  • SHA256

    d93a07c796c64276982ae6322582ffe8b6767e73d49795ac4c554e249776d0b6

  • SHA512

    37065a0fc547fa96f9d7bc6d6cad0b6ec036ec0f2c03064ff99439dffadfebc109b16ba1fa3b2e234ceb64011e44763fc6c39035a7aa7d6acd3cc7c322766ce3

  • SSDEEP

    3072:TVs3OWnGCF5YfuNsTNGXbU3E1pu1lZDcUD1kFBX5mDyd0xgrqmkfTX:JDCFHGTKbZPHUDG/YDyd0xgrqmkfTX

  Score

  9^/10

  discovery

  • Contacts a large (201060) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

  behavioral1