Extracted

• • Target

    37d1d3dd518a519b00bfdb8755baa773

  • Size

    65KB

  • MD5

    37d1d3dd518a519b00bfdb8755baa773

  • SHA1

    a2b080ce3edae5cd9890ee2e09b3b9e374385363

  • SHA256

    47f7d433db56cb121c37a66a1523777a537250958f3d895aaf3eb13ecde1dfe0

  • SHA512

    f0d2c1c64da6cd58d6583e737807549aebe1d03ca7d32a3e746829aba00fa7b9b114fb66ce4c56a28bdce05e2c81e28a18ce36fff9185f221bc09c8041c99c5d

  • SSDEEP

    1536:ugYL5AB0PRWkmh82DPakWlNRfi71CWtcQ7o3KyZL1H0YsO:ugY1AB0PRWkmh82DPzgRf01CWex3K2Lk

  Score

  9^/10

  discovery

  • Contacts a large (20625) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1